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Abstract. We consider digital expansions to the base of r, where r is an algebraic integer. For 
a w > 2, the set of admissible digits consists of and one representative of every residue class 
modulo t w which is not divisible by r. The resulting redundancy is avoided by imposing the 
width w-NAF condition, i.e., in an expansion every block of w consecutive digits contains at 
most one non-zero digit. Such constructs can be efficiently used in elliptic curve cryptography 
in conjunction with Koblitz curves. 

The present work deals with analysing the number of occurrences of a fixed non-zero digit. 
In the general setting, we study all ui-NAFs of given length of the expansion. We give an 
explicit expression for the expectation and the variance of the occurrence of such a digit in all 
expansions. Further a central limit theorem is proved. 

In the case of an imaginary quadratic r and the digit set of minimal norm representatives, 
the analysis is much more refined: We give an asymptotic formula for the number of occurrence 
of a digit in the u>-NAFs of all elements of S[r] in some region (e.g. a disc). The main term 
coincides with the full block length analysis, but a periodic fluctuation in the second order term 
is also exhibited. The proof follows Delange's method. 

We also show that in the case of imaginary quadratic r and w > 2, the digit set of minimal 
norm representatives leads to ui-NAFs for all elements of 25 [t]. Additionally some properties of 
the fundamental domain are stated. 
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1. Introduction 

Let r £ C be an algebraic integer. We consider r-adic expansions for an element of S[r] 
using a redundant digit set T>. This means that our expansions need not be unique without 
any further constraints. However, by applying a width-w non-adjacency property to the digits 
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of a representation, together with choosing an appropriate digit set, we gain uniqueness. The 
mentioned property simply means that each block of w digits contains at most one non-zero digit. 

Such expansions have a low Hamming weight, i.e., a low number of non-zero digits. This is of 
interest in elliptic curve cryptography: There, scalar multiples of points can be computed by using 
r-adic-expansions, where r corresponds to the Frobenius endomorphism. See Section [2] for a more 
detailled discussion. 

The aim of this paper is to give a precise analysis of the expected number of non-zeros in r-adic 
expansions of elements in Z[r], corresponding to the expected number of costly curve operations. 
Several random models can be considered. 

The easiest model is to consider all expansions of given length to be equally likely; this is called 
the "full block length" model. The result for arbitrary algebraic integers is given in Theorem |5.1| 
|on page 12| The appropriateness of this random model becomes debatable when looking at the 
set of complex numbers admitting such an expansion of given length: This is the intersection of 
the lattice of integers in the number field with a fractal set, a scaled version of the "Fundamental 



domain", cf. Figure 10.1 on page 34 



A more natural choice seems to be to consider the expansions of all integers in 7L[t] whose 
absolute value is bounded by some N. The main result of this paper (Theorem 11.1 on page 38 1 is 
exactly such a result, where we assume r to be a imaginary quadratic number. Theorem 11.1 is, in 



fact, more general: instead of considering all integers within a scaled version of the unit circle, we 
consider all integers contained in a scaled copy of some set U . Instead of counting the number of 
non-zeros, we count the number of occurrences of each digit. The full block length analysis result 
will indeed be needed to prove Theorem |11.1| 

For given r and block length w > 2, several digit sets could be chosen. A rather natural choice 
was proposed by Solinas 19, 20 : Consider the residue classes modulo t w in K[r]. As digit set, we 
use zero and a minimal norm representative from each residue class not divisible by r. Now let 
z e %[t\ with z = J2j= z j tJ - This 

expansion is a width- w r-adic non- adjacent form, or w-NAF 
for short, if each block of w consecutive digits Zj . . . Zj+ w -i contains at most one non-zero digit. 
The name "non-adjacent form" goes back to Reitwiesner [TS] . 

It is commonly known that such expansions, if they exist, are unique, whereas the existence 
was only known for special cases, see Section [2j In this paper in Section [7] we show that, for 
imaginary quadratic r and w > 2, every element of Z[r] admits a unique w-NAF, see Theorem 1 7. 1| 
|on page 22| Additionally a simple algorithm for calculating those expansions is given. 

The full block length analysis is carried out in Section [5] We define a random variable X n>Wt7) 
for the number of occurrences of r\ in all w-NAFs of a fixed length n. It is assumed that all 
those w-NAFs are equally likely. For an arbitrary algebraic integer r Theorem |5.1| gives explicit 
expressions for the expectation and the variance of X nw „. Asymptotically we get E(A„ w n ) ~ e w n 
and Y(X n w T] ) ~ v w n for constants e w and v w depending on w and the norm of r. The proof 
uses a regular expression describing the w-NAFs. This will then be translated into a generating 
function. Further in this theorem it is shown that X ritW _ n satisfies a central limit theorem. 

The main result is the refined analysis described above: For imaginary quadratic r, we count 
the number of occurrences Z T>WjTI of the non-zero digit ?y, when we look at all w-NAFs contained in 



NU for a given positive N and a region U C (D (e.g. the unit disc). In Theorem 11.1 on page 38 
we prove that Z T>Wj7l ~ e w N 2 X(U) log| T | N. This is not surprising, since intuitively there are about 
N 2 X(U) w-NAFs in the region NU, and each of them can be represented as a w-NAF with length 
log| r | N. We even get a more precise result. If the region is "nice", there is a periodic oscillation 
of order N 2 in the formula. 

The structure of the result — main term, oscillation term, smaller error term — is not un- 
common in the context of digits counting. For instance, a setting similar to ours can be found 
in Heuberger and Prodinger [TJ]. There base 2 and special digit sets are used, and 2-NAFs are 
considered. The result has the same structure as ours. Another example can be found in Grabner, 
Heuberger and Prodinger jlOj for joint expansions. 

As in these examples, we follow the ideas of Delange [7] to prove the statements. Before finally 
be able to prove the main result in Section [XT) we have to collect various auxiliary results. 
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Abbreviations for r 
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Table 1.1. Overview of requirements. 



Our digit set of minimal norm representatives is characterised in terms of the Voronoi cell of 
in the lattice 7L[t\. The required estimates are shown in Section [3] The digit set itself as well as 
w-NAFs are then defined and discussed in Section |4j Apart from expansions of elements in Z[r], 
we will also discuss infinite expansions of elements of (D, as these will be needed in our geometric 
arguments. Section [5] is devoted to the full block length analysis. In Section [6] we give bounds 
connecting the absolute value and the length of a tu-NAF. This allows us to prove the existence 
(Theorem 7.1 on page 22 1 of w-NAFs in Section [7j Further in Theorem |7. 5 on page 24 we get 



that every element of <C has a w-NAF-expansion of the form . . . £i£o£-i£-2 ■ • ■ , where the 
right hand side of the r-point is allowed to be of infinite length. In Section [S] we consider numbers 
of the form 0.£_i£_2 • ■ ■■ The set of all values of such numbers is called the fundamental domain 
T . It is shown that T is compact and its boundary has Hausdorff dimension smaller than 2. 
Further a tiling property with scaled versions of T is given for the complex plane. In Section|9] we 
develop a suitable notion of "fractional value". Occurrence of the digit r\ at arbitrary position can 
be characterised in terms of the so-called "characteristic sets" which are introduced in Section [lOl 
While the main focus of this paper lies on imaginary quadratic bases and the digit set of 
minimal norm representatives, some of the results, e.g. the full block length analysis (Theorem |5.1| 



on page 12), are valid in a more general setting. A more detailed overview on the requirements on 



t and digit set V for the different sections, definitions, theorems, etc. can be found in Table [TTTj 

2. Background 

In this section, we outline the connection to cryptographic applications which motivated our 
study. 
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As a first example, we consider the elliptic curve 

£ 3 : Y 2 = X 3 -X-fi with fie {-1,1} 

defined over F 3 . This curve was studied by Koblitz [15]. We are interested in the group £ 3 (F 3 ™) 
of rational points over a field extension F 3 m of F3 for an m G N. The Frobenius endomorphism 

<p: f 3 (F 3 m) ^£ 3 (W 3m ), (x,y)^ (x 3 ,y 3 ) 

satisfies the relation ip 2 — Zfjap+Z = 0. So <p may be identified with the imaginary quadratic number 
— 3 /i + 5 \/— 3, which is a solution of the mentioned relation. Thus we have an isomorphism 



, 2 

between 3[r] and the endomorphism ring of £ 3 (F 3 ™). 

Let z G S[r] and P G £ 3 (F 3 ™). If we write the element z as X^=o z .j' t: ' f° r some digits zj 
belonging to a digit set V, then we can compute the action zP as Y^,j=o z j f^(P) y ia a Horner 
scheme. The resulting Frobenius-and-add method Q3J [IjJl [30] is much faster than the classic 
double-and-add scalar multiplication. 

So we are interested in a T-adic expansion for an element of S[r] such that the mentioned 
computation of the action is as efficient as possible. The main computational effort are point 
additions, and we need one addition per non-zero element of the expansions. 

But usually fewer non-zero coefficients means larger digit sets and thus a higher pre-computation 
effort. So for optimal performance, a balance between digit set size and number of non-zeros has 
to be found. 

Another example is the elliptic curve 

£2 ■ Y 2 + XY = X 3 + aX 2 + 1 with a G {0, 1} 

defined over F2, cf. Koblitz [T3]. There we get the relation ip 2 — flip + 2 = with fi = (— l) 1 ~ a for 
the Frobenius endomorphism tp, and thus r = oM + hV~ 7. 



2 . 2 

For the r corresponding to £3 and w > 2, existence of w-NAFs was shown in Koblitz [15] and 
Blake, Kumar Murty and Xu [3], for the r corresponding to £2 and w; > 2 in Solinas f2Uj and 
Blake, Kumar Murty and Xu [S] . Some other r are handled in Blake, Kumar Murty and Xu [5] . 

3. Voronoi Cells 

Let t € C be an algebraic integer, imaginary quadratic, i.e., r is solution of an equation 
t 2 — pr + q = with p^eS, such that 4q — p 2 > 0. 

We will use the digit set of minimal norm representatives. In order to describe this digit set, we 
will rewrite the minimality condition in terms of the Voronoi cell for the lattice TL [r] , cf . Gordon [9] . 

Definition 3.1 (Voronoi Cell). We set 

V:={ze<£ : Vy G Z[t] : \z\ < \z - y\} . 

V is the Voronoi cell for corresponding to the set E[t]. Let u G S[r]. We define the Voronoi cell 
for u as 

7 U := u + V = {u + z : z G V} = {zeC : Vy G S[t] : |z - «| < \z - y\} . 
The point u is called centre of the Voronoi cell or lattice point corresponding to the Voronoi cell. 



An example of a Voronoi cell in a lattice S[r] is shown in Figure 3.1 on the next page Whenever 
the word "cells" is used in this paper, these Voronoi cells or scaled Voronoi cells will be meant. 

Two neighbouring Voronoi cells have at most a subset of their boundary in common. This can 
be a problem, when we tile the plane with Voronoi cells and want that each point is in exactly one 
cell. To fix this problem we define a restricted version of V . This is very similar to the construction 
used in Avanzi, Heuberger and Prodinger [2]. 

Definition 3.2 (Restricted Voronoi Cell). Let V u be a Voronoi cell as above and u its centre. Let 
vq, ■■■ , Vm—i with appropriate m G N be the vertices of V u labelled counter-clockwise. We denote 
the midpoint of the line segment from vt to v^+i by Ufe+1/2, and we use the convention that the 
indices are meant modulo m. 

The restricted Voronoi cell V u consists of 



ANALYSIS OF WIDTH-™ NON-ADJACENT FORMS 



5 




FIGURE 3.1. Voronoi cell V for corresponding to the set S[r] with r 



n "i" o \/ 3. 



^1 
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V 3 .5^ ^4.5 
V 4 



FIGURE 3.2. Restricted Voronoi cell V for corresponding to the set S[r] with 



• the interior of V u , 

• the line segments from Wfc_|_i/2 (excluded) to Vk+i (excluded) for all k, 

• the points v k+1 / 2 for k £ {0, . . . , 1^1 — l}, an d 

• the points v k for k £ {l, . . . , [yj }. 

Again we set V := Vq. 



In Figure [3T2] the restricted Voronoi cell for is shown. The second condition is used, because it 
benefits symmetries. The third condition is just to make the midpoints unique. Obviously, other 
rule^] could have been used to define the restricted Voronoi cell. 

As a generalisation of the usual fractional part of elements in R with respect to the integers, 
we define the fractional part of an element of (D corresponding to the restricted Voronoi cell V 
and thus corresponding to the lattice Z[t]. 

Definition 3.3 (Fractional Part in S[r]). Let z £ <C, z = u + v with u £ Z[r] and v £ V. Then 
we define the fractional part corresponding to the lattice TL\r\ by {z} Z [ r j := v. 

This definition is valid, because of the construction of the restricted Voronoi cell. The fractional 
part of a point z £ (D simply means, to search for the nearest lattice point u of S[r] and returning 
the difference z — u. 

Throughout this paper we will use the following notation for discs in the complex plane. 

Definition 3.4 (Opened and Closed Discs). Let z £ <C and r > 0. The open disc B(z,r) with 
centre z and radius r is denoted by 



B(z,r) :={y£<C : \z - y\ < r} 



^The rule has to make sure that the complex plane can be covered entirely and with no overlaps by restricted 
Voronoi cells, i.e., the condition <C = l+J zg a[ T ] V z has to be fulfilled. 
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and the closed disc B(z,r) with centre z and radius r by 

B(z,r) :={y£<D : \z-y\ <r}. 

The disc B(0, 1) is called unit disc. 

We will need suitable bounds for the digits in our digit set. These require precise knowledge 
on the Voronoi cells, such as the position of the vertices and bounds for the size of V. Such 
information is derived in the following proposition. 

Proposition 3.5 (Properties of Voronoi Cells). We get the following properties: 
(a) The vertices ofV are given by 

vo = 1/2 + (lm(r) 2 + {Re(r)} 2 - {Re(r)}) , 

Vl = {Re(r)} - \ + 2^ (lm(r) 2 - {Re(r)} 2 + {Re(r)}) , 

v 2 = -1/2 + (lm(r) 2 + {Re(r)} 2 - {Re(r)}) = v - 1, 

V3 = -vo, 

V 4 = -Vl 



and 



V 5 = -V2- 

All vertices have the same absolute value. If Re(r) G 7L, then vi — v 2 and v^ ~ v^, i.e., the 
hexagon degenerates to a rectangle. 

(b) The Voronoi-cell V is convex. 

(c) We get the bounds 

B(0,|) C VCB(0,\t\c v ) 

with cy = \J^2- 

(d) The Lebesgue measure ofV in the complex plane is 

A(V) = |Im(r)|. 

(e) The inclusion t~ x V C V holds. 

Before we start with the proof of this proposition, we add some remarks on the constant cy . 
Solinas [20] uses the Voronoi cell for the special r = \ + \\f— 7 with cy = ^/|. The upper- 
bound cy = \J~^2 m Q °f ^ nc proposition is not sharp. Indeed, with some effort, one could prove 
cy = \/f • A smaller cy leads to better bounds in Section J^J Further, the set of "problematic 



values" — those arise in the proof of the upper bound in Proposition 6.1 on page 15 and the lower 



bound in Proposition |6.2 on page 17[ as well as in the existence result in Theorem 7.1 on page 22 



is decreased. This means fewer configurations have to be checked separately. As some of the 
computational verifications would still be necessary even with cy = \J\, the improvement does 
not seem to outweigh the effort. 

Now back to the proof of Proposition |3.5| We will use some properties of Voronoi cells there, 
which can, for example, be found in Aurenhammer pp. 

Proof, (a) Since V is point-symmetric with respect to 0, we get v = —v 3 , V\ = —v^ and w 2 = ~ v 5- 
Thus we suppose without loss of generality Im(r) > 0. Strict greater holds, because r is 
imaginary quadratic. Even more, we get Im(r) > since 

n i i 
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Figure 3.3. Construction of the Voronoi cell V for 0. The picture shows a 
general situation. Since r is an imaginary quadratic algebraic integer, we will 
have Re(f) € {0, §}. 



is solution of r 2 — pr + q = for p, q E 7L and either 4q — p 2 = (mod 4) or 4q — p 2 = — 1 
(mod 4). 

All elements of the lattice E[r] can be written as a + 6r, since r is quadratic. We have to 
consider the neighbours of in the lattice. The Voronoi cell is the area enclosed by the line 
segment bisectors of the lines from each neighbour to zero, see Figure [3~3) 

Clearly Re(w ) = \ and Re(i> 2 ) = since —1 and 1 are neighbours. Set f — {Re(r)} + 
zlm(r). Consider the line from to r with midpoint ir. We get 

V = -T— X A IT 

and 

for some xa € K.>o and Xb € !R>o- Analogously, for the line from to r — 1, we have 

Vx = i (r - 1) - x c i (r - 1) 

and 

v 2 = - (r - 1) + x D i (r - 1) . 

for some € R>o and xd & R>o- Solving this system of linear equations leads to the desired 
result. An easy calculation shows that \v \ = \vi\ — 

Until now, we have constructed the Voronoi cell of the points 

P:={0,l,-l,T,r-l,-f,-(T-l)}. 

We want to rule out all other points, i.e., make sure, that none of the other points changes 
the already constructed cell. So let z — x + iy € TL [r] and consider | . Because of symmetry 
reasons, we can assume x > and y > 0. Clearly all points z € TL with z > 2 do not change 
the Voronoi cell, since | > | and the corresponding line segment bisector is vertical. So we 
can assume y > 0. 

Now we will proceed in the following way. A point z can be ruled out, if the absolute value 
of | is larger than 

fl=hl = N = |«a|. 
Let r = a + ib. If {a} = 0, then R 2 = \ (l + 6 2 ). We claim that 

R 2 <^±^^l + b 2 <x 2 + y 2 . 
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Since y > 0, we have y > b. If y = b, then points with x > 1 need not be taken into 
account. But the remaining points are already in P (at least using symmetry and f + 1 
instead off — 1). If y > 2b, then all points except the ones with x = can be ruled out, since 
1 — b 2 < 1 — \ = \ < x. But the points z with x = can be ruled out, too, because there is 
already the point ib in P. 

So let {a} = |. Then R 2 = j (| + fc 2 + 3^2) and we claim that 

If y = b, then x > \/ jn suffices to rule out a point z, since 6 > But the only point z with 



a; < y T2 is 5 which is already in P. If y > 2b, then g — b + — | + y^<0, so 

all points can be ruled out. 

(b) Follows directly from the fact that all vertices have the same absolute value. 

(c) From 

v = 1/2 + V f Im(f f + Rc(f ) 2 - Re(f) 



we obtain 



2Im(T)\ 



<Im(?) 2 



M |l + ilm(r)| Im(f) / 1 / J_ _ 

|r| " 2\r\ ~ 2 |f I V Im(f) 2 V 12 



since ^ < T m (f) < Therefore V C S(0, |r| c y ). 

Since < Re(f) < 1, we see that Im(«i) > Im(wo) = Im(v2)- By construction, the line 
from to f intersects the line from vo to v\ at ^f , so \ \t\ is an upper bound for the largest 
circle inside V. Analogously we get \ |f — 1| as a bound, and from the line from to 1 we get 
|. Since f and f — 1 are lattice points and not zero, their norms are at least 1, so B(0, |) is 
inside V. 

(d) The area of V can be calculated easily, because Im(i>o) = Im(i>2). Thus, splitting up the region 
in a rectangle and a triangle and using symmetry, the result follows. 

(e) Let x £ t~ 1 V. Thus x = t~ x z for an appropriate z G V . For every y £ /Z[t] we obtain 

\x\ = I 1 1 \z\ < I -7" 1 1 \z — y\ = \x — T _1 y| . 
For an arbitrary u G Z[t] we can choose y = tu, and therefore \x\ < \x — u\, i.e., x G V. □ 

We make an extensive use of Voronoi cells throughout this article, especially in Section|9] There 
we define cell rounding operations which are working on subsets of the complex plane. 

4. Digit Sets and Non- Adjacent Forms 

In this section r G (D will be an algebraic integer with |r| > 1, and let w G N with w > 2. 
Further let N ': Z[r] — ► Z denote the norm function. We want to build a numeral system for the 
elements of E[t] with base r. Thus we need a digit set T>, which will be a finite subset of Z[t] 
containing 0. 

Definition 4.1 (Reduced Residue Digit Set). Let T> C Z[r]. The set I? is called a reduced residue 
digit set modulo t w , if it consists of and exactly one representative for each residue class of % [r] 
modulo t w that is not divisible by r. 

From now on suppose T> is a reduced residue digit set modulo t w . The following two auxiliary 
results are well-knowrj^J we include a proof for the sake of completeness. 

Lemma 4.2. Let c be a rational integer. Then r divides c in S[r] if and only if A/"(r) divides c 
in 7L. 



2 Although those results are well-known, we were not able to find a reference. Any hints are welcome. 
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Proof. From the minimal polynomial, it is clear that r divides A/"(r) in S[r], so A/"(r) | c implies 

T | C. 

For the converse direction, assume that r ■ ^X)j=o x j t "') = c f° r some rational integers x^. Here 
d is the degree of t. Write the minimal polynomial of r as 

r d + a j T ' J = °- 

Thus we obtain 

d-1 

c = -x d _ia + 2j(ajj_i - Xd^xa^r 3 . 
3=1 

Comparing coefficients in t 3 yields c = — a^-ido, which implies that do = (— l) d M{t) divides c in 
7L, as required. □ 

Next, we determine the cardinality of T> by giving an explicit system of representatives of the 
residue classes. 

Lemma 4.3. A complete residue system modulo t w is given by 

a^T 3 with a,j G {0, . . . , |W(t)| - 1} for 0<j<w. (4.1) 

3=0 

In particular, there are \jV(t)\ w residue classes modulo t w in S[r]. 

A representative X^7=o a 3 T ^ with aj 6 {0, . . . , |7V(t)| — 1} is divisible by r if and only if aq = 0. 
In particular, the cardinality of T> equals \M{r)\ w 1 (|A/"(r)| — 1) + 1. 

Proof. Every element z of 7L [r] can be written as 

w— 1 

Z = XT W + OjT 3 
3=0 

for some aj G {0, . . . , |A/"(t) | — 1} and an appropriate x € Wi[t]: Take the expansion of z with 
respect to the S-basis t 3 , < j ' < d and subtract appropriate multiples of the minimal polynomial 
of r in order to enforce < Oj < \AT(t)\ for < j < w — 1. This shows that (4.1) indeed covers 
all residue classes modulo t w . 

Assume that J2j=o a 3 T ^ = ^j^o bjT 3 (mod t w ) for some aj, bj G {0, . . . , |A/"(t)| — 1}, but 
aj 7^ bj for some j. We choose < < w — 1 minimal such that aj ^ bj . We obtain 

w— 1 w— 1 

a 3 r J '^° = fej-r^J' (mod T™"- 7 ' ), 

J=jo 3=30 

which implies that a JO = bj (mod r). By Lemma 4.2 on the preceding page this implies that 
a 3a = bj a , contradiction. Thus (4.1) is indeed a complete system of residues modulo t w . 

From Lemma 4.2 on the facing page we also see that exactly the \Af(r)\ w ~ residue classes 

IV— 1 4 V • -I 1 1 -ITT 1 T jl j I » ft \[W— 1 



Ej=i a j rj are divisible by r. We conclude that #P = |A/"(r)r _1 (|JV(r)| - 1) + 1. □ 

Since our digit set I? is constructed of residue classes, we want a uniqueness in choosing the 
representative. We have the following definition, where the restricted Voronoi V for the point 
from Definition 1 3. 2 on page 4| is used. 

Definition 4.4 (Representatives of Minimal Norm). Let r be an algebraic integer, imaginary 
quadratic, and let r\ € S[r] be not divisible by t. Then n is called a representative of minimal 
norm of its residue class, if rj £ t w V. 

With this definition we can define the following digit set, cf. Solinas [HI [20] or Blake, Kumar 
Murty and Xu @]. 
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Figure 4.1. Minimal norm representatives digit sets modulo t w for different r 
and w. For each digit rj, the corresponding Voronoi cell V v is drawn. The large 
scaled Voronoi cell is t w V. 



Definition 4.5 (Minimal Norm Representatives Digit Set). Let r be an algebraic integer, imagi- 
nary quadratic, and let I? be a reduced residue digit set modulo t w consisting of representatives 
of minimum norm of its residue classes. Then we will call such a digit set minimal norm repre- 
sentatives digit set modulo r w . 

From now on we will suppose that our digit set I? is a minimal norm representatives digit set 



modulo t w . Some examples are shown in Figure 4.1 There are also other definitions of a minimal 



norm representative digit set, as discussed in the following remark. 



Remark 4.6. The definition of a representative of minimal norm, Definition 4.4 on the previous 



page — and therefore the definition of a minimal norm representative digit set, Definition 4.5 



depends on the definition of the restricted Voronoi cell V, Definition 



3.2 



There we had some 



freedom choosing which part of the boundary is included in V , cf. the remarks after Definition 



3.2 



We point out that all results given here in this article arc valid for any admissible configuration of 



the restricted Voronoi cell, although only the case corresponding to Definition 3.2 will be considered 
(to prevent the paper from getting any longer). For most of the proofs given, this makes no 
difference, but there are some exceptions. The cases with "problematic values" in Sections [6] and [7] 
are solved algorithmically, and therefore the results clearly depend on choice of the digit set. 
Luckily the final results are true in each situation. 

The following remark summarises some basic properties of minimal norm representatives and 
the defined digit sets. 

Remark 4.7. Let r be an algebraic integer, imaginary quadratic. We have the following equivalence. 
The condition 

\v\ < Ifl for all £ e 7L[t\ with 77 = f (mod r w ) 

is fulfilled, if and only if 77 € t w V. The advantage of using the restricted Voronoi cell in Defini- 
tion |4.4 on the previous page] is that also points on the boundary are handled uniquely. 

Further we get for all n £ T> that |r/| < Irl*" -1 " cy. On the other side, if an element of Z[r] 
which is not divisible by r, has absolute value less than | \t\ w , cf. Proposition 3.5 on page 6 
a digit. See also Lemma |4. 3 on the previous page 



it is 



Since T> C S[r], all non-zero digits have absolute value at least 1. 

We can assume that < arg(r) < \. Using any other r lead to the same digit sets, except 
some mirroring at the real axis, imaginary axis, or at the origin. By adapting the definition of the 
boundary of the restricted Voronoi cell, Definition |3.2 on page 4[ these mirroring effects can be 
handled. 

Now we are ready to define the numbers built with our digit set T>. 
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Definition 4.8 (Width-w r-adic Non-Adjacent Forms). Let r\ — € £> z . The sequence 

77 is called a width-w r-adic non-adjacent form, or w-NAF for short, if each factor rjj +w -i . . .rjj, 
i.e., each block of length w, contains at most one non-zero digit. 

Let J = {j g % : rjj ■ ± 0}. We call sup({0} U (J+ 1)) the left-length of the w-NAF 77 and 
- inf ({0} U J) the right-length of the w-NAF 77. 

Let A and p be elements of No U {fin, 00}, where fin means finite. We denote the set of all 
w-NAFs of left-length at most X and right-length at most p by NAF^,'' 3 . If p = 0, then we will 
simply write NAF^. The elements of the set NAF^ n will be called integer w-NAFs. 

For 77 g NAF* n -°° we call 

value(r7) := r/j r J 

the value of the w-NAF 77. 

The following notations and conventions are used. A block of zero digits is denoted by 0. For 
a digit 77 and k g No we will use 

V k ■= ?7 • • • 

k 

with the convention n := e, where e denotes the empty word. A w-NAF 77 = (i]j)j eZ will be 
written as rij.rjp, where rjj contains the rjj with j > and 77^? contains the r/j with j < 0. 77/ is 
called integer part, r]p fractional part, and the dot is called r-point. Left-leading zeros in 77/ can 
be skipped, except 770, and right-leading zeros in 77^ can be skipped as well. If 77^ is a sequence 
containing only zeros, the r-point and this sequence is not drawn. 

Further, for a w-NAF 77 (a bold, usually small Greek letter) we will always use 77^ (the same 
letter, but indexed and not bold) for the elements of the sequence. 

To see where the values, respectively the fractional values of our w-NAFs lie in the complex 
plane, have a look at Figure |10.1 on page 34| There some examples are drawn. 

The set NAF^ n '°° can be equipped with a metric. It is defined in the following way. Let 
77 g NAF* n -°° and £ g NAF^ n '°°, then 

1 |max{je2:%^e 3 } if 77 ^ £ 

ifr7 = £. 

So the largest index, where the two w-NAFs differ, decides their distance. See for example Edgar [8] 
for details on such metrics. 

We get the following continuity result. 

Proposition 4.9. The value function value is Lipschitz continuous on NAF* n '°°. 

Proof. Let Cx> be a bound for the absolute value of the digits in the digit set V. Let 77 g NAF^ n '°° 
and£ G NAF f J-°°, 77 7^ 
larger than J we obtain 



dNAF(»7,£) := 



and £ g NAF^ n '°°, 77 7^ £, with cInaf (^7: £) = \ T \ J ■ Since 77 and £ are equal on all digits with index 



|value(7,) - value(|)| < ]T ~ £j\ \r\ J < 2c v ^ = - 2 ° V d NAF (r7,£) . 

Thus Lipschitz continuity is proved. □ 
Furthermore, we get a compactness result on the metric space NAF^°° C NAF^ n '°° in the 



proposition below. The metric space NAF f ^ n "°° is not compact, because if we fix a non-zero digit r\, 
then the sequence (77(F) - g]No has no convergent subsequence, but all rfP are in the & 

Proposition 4.10. For every t > the metric space ^NAF^°°, d[\iAF^ is compact. 



Proof. Let (£o,j),- £No be a sequence with £ j € NAF^°°. We can assume £ ,j € NAF° -oc 
therefore each word £o,j has digits zero for non-negative index. Now consider the digit with index 
— 1. There is a subsequence (£i,i),- 6 iN °f (^o.jLeNo' such that digit —1 is a fixed digit r\_i. Next 
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there is a subsequence ($,2.j)j £ -^ of (£ij)j£N ' such that digit —2 is a fixed digit rj_ 2 . This process 
can be repeated for each k > 1 to get sequences (^fc,j) je]No and digits r\-k- 

The sequence ipj)j^ a with -dj := £j t j converges to r\, since for e > there is an J £ No such 
that for all j > J 

d NAF (»7,^)< |r|- (J+1) <e. 



It is clear that 77 is indeed an element of NAF°"°°, as its first fc digits coincide with ^.k € 
NAP°-°° for all fc. So we have found a converging subsequence of (Co,i)jgN ; which proves the 
compactness. □ 

Remark 4.11. The compactness of ^NAF^°°, dNAF^ can also be deduced from general theory. As 

a consequence of Tychonoff 's Theorem the set U N is a compact space, the product topology (of 
the discrete topology on V) coincides with the topology induced by the obvious generalisation of 
the metric dwAF- The subset NAF°'°° C T) m is closed and therefore compact, too. 

We want to express all integers in S[r] by finite w-NAFs. Thus we restrict ourselves to suitable 
digit sets, cf. Muir and Stinson [TT] . 

Definition 4.12 (Width-w Non-Adjacent Digit Set). A digit set T> is called a width-w non- 
adjacent digit set, or u>-NADS for short, when every element z £ S[r] admits a unique w-NAF 
t] £ NAF^ n , i.e., value(r7) = z. When this is the case, the function 

value| NAF ,. : NAF* n — ■+ 7L\t\ 

is bijective, and we will denote its inverse function by NAF^,. 

Later, namely in Section [7J we will see that the digit set of minimal norm representatives is a 
ui-NADS if r is imaginary quadratic. 

5. Full Block Length Analysis of Non- Adjacent Forms 

Let t £ <D be an algebraic integer, w £ N with w > 2, and V be a reduced residue digit set, cf. 
Definition 4.1 on page 8 Let JV: Z[r] — > 7L denote the norm function. 

Further, in this section all w-NAFs will be out of the set NAFj 1 , and with length the left-length 
is meant. 

This general setting allows us to analyse digit frequencies under the full block length model,, 
i.e., we assume that all w-NAFs of given length are equally likely. We will prove the following 
theorem. 

Theorem 5.1 (Full Block Length Distribution Theorem). We denote the number of w-NAFs of 
length n £ No by C 7hW , i.e., C n , w = #(NAF"), and we get 

c niW = p^Tj^Ti MrT +w + °((pMrW) , 

where p= (1 + ^pr )" 1 < 1. 

Further let ^= r\ £ T> be a fixed digit and define the random variable X n w 7] to be the number 
of occurrences of the digit r\ in a random w-NAF of length n, where every w-NAF of length n is 
assumed to be equally likely. 

Then the following explicit expressions hold for the expectation and the variance of X n WtJ] : 



E(X m ) = e w n + — , K J_\' 7 ^ - + 0(n P n (5.1) 



(\N(t)\ - l)(w- l)w 

(«.-l)u.(-(«)-l) 2 -|A^(T)| 2 t U 2 + (|Ar(r)|-l)|Ar(T)r'- 1 ((|AA(r)|-l)u,+l) 2 +2|A^(T)|(«) 2 -«)+l)) 

\M(r)\ 2w - 2 ((\N(r)\-l)w + iy 
+ 0(n 2 p n ), (5.2 
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where 



and 



I^I^PWI-i^ + i)' 

INjr)] 1 "- 1 ({\N(t)\ - l)w + l) 2 - (W(t)\ - l)w 2 + 2w-l) 
|AA(T)r- 2 ((|AA(r)|-]> + l)3 



Furthermore, X n:WtV satisfies the central limit theorem 



/v„,n 



< x = $(ar) + 



1 

' 



uniformly with respect to x G R 7 where &(x) = (2ir) 1 I 2 J t<x e * / 2 is £/ie standard normal 
distribution. 

For the proof we need estimates for the zeros of a polynomial which will be needed for estimating 
the non-dominant roots of our generating function. 



Lemma 5.2. Let t > 2 and 



/(*) 



t 



TTien /(z) ftas exactly one root with \z\ < 1 + A, namely 2 = 1. 

Proof. It is easily checked that /(l) = 0. Assume that z ^ 1 is another root of /. As the 
coefficients of / are reals, it is sufficient to consider z with Im(z) > 0. If \z\ < 1, then 



1 



1 

-z - 



which is a contradiction. Therefore, we have \z\ > 1. We write z = re % ^ for appropriate r > 1 and 
< "0 < 7T. For r > 0, /(r) is strictly decreasing, so we can assume that ip > 0. 

For if) < tt/w, we have sm(wip) > and sm(ip) > 0, which implies that Im(/(re 1 ^)) = — \ sin^— 
(l — |j sin(-0t(j) < 0, a contradiction. We conclude that if) > ir/w. 

Next, we see that f(re^) — implies that 



2r r 2 
l__ cosV , + _ 



.,2".' 



We have cos if) < cos(?r/w), which implies that 



1 



t 



r 2w > j 



2r 7r r 2 
— cos - + — 
t w t A 



1 



1 — cos ■ 



7r \ 2r 



w/ t 



(5.3) 



For w > 4 and r < v2, the right hand side of ( 5.3 ) is decreasing and the left hand side is increasing. 
Thus, for r < 1 + l/(tw 3 ), yields 

2 



1 

1- - 
t 



1 



1 

tw 3 



1 



1 



I c 71 ] 2 I 1 1 

w/ t \ tw 3 



Using the estimates (1 



_J_\2w < i , _2_ 
tw 3 I — 1 + ttu 2 1 t 2 «; 



|-4 and cos (£) < 1 - A + =£-f, we obtain 



2-7T 2 



1 

t 2 ' t 3 J u/ 2 







t 3 


H 

/ 








7T 4 


+( 


12i "* 



IV 



1_ J_ ^ 4 



12t 2 



which is a contradiction for u> > 4 and t > 2 

For w = 3, we easily cl 
|z|=t/(t-l)>l + l/(4i) 



For u> = 3, we easily check that \z\ = \l jz\ > 1+ l/(27t); similarly, for w = 2, we have 

□ 
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Proof of Theorem \5.1\ For simplicity we set V* :— V \ {0}. A w-NAF can be described by the 
regular expression 



w-2 



dev 



Let a mn be the number of ui-NAFs of length n containing exactly m occurrences of the digit r). 
We consider the generating function G(Y, Z) = J2 m n a mnY m Z n . From the regular expression we 
see that 

1 ' ' 1 - Z - YZ W - (#£>• - \)Z W ' 
We start with determining the number of w-NAFs of length n. This amounts to extracting the 
coefficient of Z n of 

1 + - 1)Z - #£>• • Z w 

(1 - Z)(l - Z - #V ■ Z w ) ' 
This requires finding the dominant root of the denominator. Setting z — |7V(t) | Z in the second 
factor yields 



G(l,Z) = 



1 



f 



1 



1 



Mt)\ 



From Lemma |5.2 on the previous page we see that the dominant root of the denominator of G(l, Z) 
is Z = 1/ \Af(r)\, and that all other roots satisfy \Z\ > 1/ \Af(r)\ + l/(|A/"(r)| 2 w 3 ). Extracting the 
coefficient of Z n of G(l, Z) then yields the number C n:W of iu-NAFs of length n as 

f 

(W(t)\ -1)10+1 
where p = (l + ^Jy^)- 1 . 



|AA(r)| 



■o{{pW{t)\T). 



(5.4) 



The number of occurrences of the digit \i amongst all w-NAFs of length n is 



[Z 71 



dG(Y, Z) 
dY 



Z 



Y=l 
1 



(i-^-(i-wk)d^)l^) 2 

,„ +1 , (PV(T)| - 1)(W-1)W 



■Mt)\' 



((|JV(t)| -l)w + l) 3 



" ((|AA(r)|-l)™ + l) 2 

Dividing this by (5.4) yields ( |5.1| ). 

In order to compute the second moment, we compute 

rn] d 2 G(Y,Z) 



Mt)\ 



n+l 



0((p\Af(r)\r). 



[Z n 



dY 2 



2Z 



w + l 



Y=l 



1-Z 



((|AT(r)| -!)«; + 1)3 



Mt)\ 



n—w-\- 



2 , ((|AA(r)|-lK-2 W |AA(r)| + l) 



Mt)\ 



n—w-\-2 



(w - l)w (w \Af(r)\ 2 - 2 |JV(t)| - w + l) 



|AA(r)| 



0((ppV(r)m, 



which after division by (5.4) yields 

^(^n,u>,?7 (-^71,10,77 1)) 



|AA(r)| 2 - 2 ((|AA(r)|-l) W + l)2 

((|JV(t)| - l)w 2 - 2w |AA(r)| + 1) ( u ' - !) w ( w l-^(r)| 2 - 2 \M{t)\ -w + l) 
|AA(r)r- 2 ((|AA(r)|- 1)^ + 1)3" lA^r^ 2 ((|^(r)| - l)w + l) 4 



+ 0(nV) 



Adding K(X ntWif) ) — K(X niW>ri ) yields the variance given in (5.2). 

The asymptotic normality follows from Hwang's Quasi-Power-Theorem |13) . 



□ 
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6. Bounds for the Value of Non-Adjacent Forms 

Let t £ (D be an algebraic integer, imaginary quadratic with minimal polynomial X 2 — pX + q 
with p, q £% such that Aq — p 2 > 0. Suppose that |r| > 1. Let w £ N with w > 2. Further let 2? 
be a minimal norm representatives digit set modulo t w as in Definition |4. 5 on page 10} 

In this section the fractional value of a w-NAF means the value of a w-NAF of the form O.r/. 
The term most significant digit is used for the digit r)-\. 

So let us have a closer look at the fractional value of a w-NAF. We want to find upper bounds 
and if we fix a digit, e.g. the most significant one, a lower bound. We need two different approaches 
to prove those results. The first one is analytic. The results there are valid for all combinations 
of t and w except finitely many. These exceptional cases will be called "problematic values". To 
handle those, we will use an other idea. We will show an equivalence, which directly leads to 
a simple procedure to check, whether a condition is fulfilled. If this is the case, the procedure 
terminates and returns the result. This idea is similar to a proof in Matula [16] . 

The following proposition deals with three upper bounds, one for the absolute value and two 
give us regions containing the fractional value. 

Proposition 6.1 (Upper Bounds for the Fractional Value). Let rj £ NAF^' 00 , and let 

_ \t\ c v 

J U T II —w ' 

1 - \t\ 

Then the following statements are true: 

(a) We get 

|value(j7)| < f v . 

(b) Further we have 

valued) e |J b(z,\t\~ w f v ) . 

zf z T u,-ly 

(c) The following two statements are equivalent: 

(1) There is an I S N , such that for all £ € NAF^' the condition 

H(value(0,M-*/tf) C r 2w - x int(V) 

is fulfilled. 

(2) There exists an e > 0, such that for all i9 € NAF^°° the condition 

B(value(0),e) C T 2w ^V 

holds. 

(d) We get 

value(rj) € r 2w - x V. 

(e) For t £ No we have 

value(0.?7_i . . . r,-i) + t~ £ V C t 2 ^ 1 V. 

Proof, (a) We have 



|value(j7)| = 



3=1 



OO 

<5>-ii 

3=1 



We consider w-NAFs, which have n^j ^ for —j = 1 (mod w). For all other w-NAFs the 
upper bound is smaller. To see this, assume that there are more than w — 1 adjacent zeros in 
a ui-NAF or the first digits are zero. Then we could build a larger upper bound by shifting 
digits to the left, i.e., multiplying parts of the sum by |r|, since \t\ > 1. 



16 



CLEMENS HEUBERGER. AND DANIEL KRENN 



We get 



|value(T7)| < ^ |r/_ 3 | |r| 3 = ^ H = 1 ( mod w )] \ T \ 



< T 



1 \ A I I I i— wk 

2_^\V-( w k+i)\\r\ 

in which we changed the summation index according to wk + 1 = j and the Iversonian notation 
[expr] = 1 if expr is true and [expr] = otherwise, cf. Graham, Knuth and Patashnik [11] , 
has been used. Using \i]^( w k+i) | < |r| u,+1 cy, see Remark 4.7 on page 10 yields 

I I / \ I j I — 1 j |M>+1 1 l T l C V 

|value(Tj)| < |r| |r| cy- — - = — - . 

l-|r| 1 - \t\ 

=--fu 

(b) There is nothing to show if the w-NAF rj is zero, and it is sufficient to prove it for ?7_i ^ 0. 
Otherwise, let k £ N be minimal, such that ?7_/ £ ^ 0. Then 

r-Cfc-D^-i valued) Gr-C*" 1 ) (J |t|- w fr) C |J b(z, \r\~ w f a 



since |r| > 1 and r 1 V C ]/, see Proposition 3.5 on page 6 

Since r/_i £ t w V, see Remark |4. 7 on page 10 we obtain t^-it -1 e t w ~ 1 V . Thus, using 
Q, yields 

\r w (valued) - r?^" 1 ) | < fa, 

i.e., 

valued) eF^-ir-MTl-™^), 



(c) 



which proves the statement. 



Suppose there exists such an I £ N. Then there exists an e > such that 
gfvalue(0, IrfVc/ + e) C r 2 — V 



for all £ e NAF°- £ , since there are only finitely many £ £ NAF^. Let ■& £ NAF°'°°. 
Then there is a £ £ NAF°' f such that the digits from index — 1 to —i of £ and # coincide. 
By using Q we obtain 

|value(0)-value(£)| < \t\~ 1 fv, 

and thus 

S(value(0),e) C Bfvalue(£), M _/ /i; + e) C T au, - 1 V. 

© (Qp. Now suppose there is such an e > 0. Since there is an I £ N such that 
\t\~ 1 fu < e, the state ment follows. 

that b(0, I Irl 2 ™ 1 " 1 ) C t 2 "'-^. Therefore, if the 



(d) We know from Proposition 



3.5 on page 6 



upper bound found in Q fulfils 



= M Cy < 1 

l-|r| i 

the statement follows. 

The previous inequality is equivalent to 

1 |t| Cy 



v ' 2 wr - 1 



> o. 



The condition is violated for w — 2 and |r| equal to y/2, -\/3 or s/4, and for iu = 3 and \t\ = v2, 
see Table 6.1 on page 18 Since v is monotonic increasing for \r\ and for w, there are no other 
"problematic cases". 
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For those cases we will use del. For each of the "problematic cases" an I satisfying the 
condition ([I]) of equivalences in (c| was found, see Table 6.2 on the following page for the 
results. Thus the statement is proved, 
(e) Analogously to the proof of Q, except that we use I for the upper bound of the sum, we 
obtain for v £ V 



|value(0.?7_i . . . rj-t) + r v\ < |value(0.?7_i 

i \ w 

T Cy 



< 



Since 1 



< 



\t\ < 1 we get 



1 1 w 

|r| Cy 

l-\r\- u 

I 1^ 



(i-bf 
(i-bf 



T]-e)\ + \t l \ \t\c v 



-t+i 



Cy 



1-lrl 



«+l-2io x 



|value(0.?7_ 



.rj- e ) + T- e V\ < 



1 



cv _ , 
- JU 



for all f£N„. 

Let z £ C. Have again a look at the proof of Q. If v > there, we get that \z\ < fu 
implies z G t 2w ~ 1 V. 

Combining these two results yields the inclusion for v > 0, i.e., the "problematic cases" are 
left. Again, each of these cases has to be considered separately. 
For each of the problematic cases, we find a k € No such that 

-k 



B value(£),2|Tr K A/ Cr 



holds for all £ € NAF° -fc . These k are listed in Table 6.3 on page 19 



For I > k and v £ V, we obtain 

|value(0.0 . . . Orj-^+i) ■ ■ ■ V-i) + ' 



v\ < \r\ fu + \t\ \t\ c v 
<\rr k fu(l + 



cy_ 
fu 



M^fu 



1 



1- T 



using jaj, Proposition 3.5 on page 6 
£>k. 



and 



<2|r|- fc fu 

> 1. Thus the desired inclusion follows for 



For the finitely many I < k we additionally check all possibilities, i.e., whether for all com- 
binations of i9 G NAF^/ and vertices of the boundary of value(i9) + r~ e V the corresponding 
value is inside r 2 ™'~ 1 V '. Convexity of V is used here. All combinations were valid, see last 
column of Table [6^3 on page 19| thus the inclusion proved. □ 

We remark that the check of the "problematic cases" in the proofs of ([d} and Q depends on the 
choice of the digit set T>, cf. Remark 4.6 on page 10 The results in Tables [672] and [6~3"1 are for the 
choice of T> that corresponds to Definition |3. 2 on page 4 Similar values can be found for all other 
choices with the exception of the case p = and q = 2. In this case, there are digit set choices 
such that the equivalent conditions in ([c]) — which are used to prove the last two statements of 
the proposition — are not fulfilled. But also in those exceptional cases it is not too hard to show 
that ([d]) and Q of Proposition 6.1 on page 15 still hold. 

Next we want to find a lower bound for the fractional value of a w-NAF. Clearly the ui-NAF 
has fractional value 0, so we are interested in cases, where we have a non-zero digit somewhere. 

Proposition 6.2 (Lower Bound for the Fractional Value). The following is true: 
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w = 2 


w = 3 


w = 4 


M 


= V2 


-0.58012 


-0.09074 


0.13996 


M 


= V3 


-0.16144 


0.18474 


0.33464 


\r\ 


= yft 


-0.00918 


0.28178 


0.39816 


\r\ 


= V5 


0.07304 


0.33224 


0.42884 



Table 6.1. Values (given five decimal places) of v = | — rjijjirri f° r different |r| 
and to. A negative sign means that this value is a "problematic value". 



q = h\ 2 




Re(r) 


Im(r) 


w 


^ found? 


I 


\r\- l fu 


e 


2 


-2 


-1 


1 


2 


true 


8 


0.1909 


0.03003 


2 


-1 


-0.5 


1.323 


2 


true 


4 


0.7638 


0.02068 


2 








1.414 


2 


true 


6 


0.3819 


0.1484 


2 


1 


0.5 


1.323 


2 


true 


4 


0.7638 


0.02068 


2 


2 


1 


1 


2 


true 


7 


0.27 


0.08352 


2 


-2 


-1 


1 


3 


true 


2 


1.671 


0.4505 


2 


-1 


-0.5 


1.323 


3 


true 


2 


1.671 


0.4726 


2 








1.414 


3 


true 


2 


1.671 


0.4505 


2 


1 


0.5 


1.323 


3 


true 


2 


1.671 


0.4726 


2 


2 


1 


1 


3 


true 


2 


1.671 


0.4505 


3 


-3 


-1.5 


0.866 


2 


true 


1 


1.984 


0.03641 


3 


-2 


-1 


1.414 


2 


true 


2 


1.146 


0.5543 


3 


-1 


-0.5 


1.658 


2 


true 


2 


1.146 


0.4581 


3 








1.732 


2 


true 


1 


1.984 


0.03641 


3 


1 


0.5 


1.658 


2 


true 


2 


1.146 


0.4581 


3 


2 


1 


1.414 


2 


true 


2 


1.146 


0.5543 


3 


3 


1.5 


0.866 


2 


true 


1 


1.984 


0.03641 


4 


-3 


-1.5 


1.323 


2 


true 


1 


2.037 


0.9164 


4 


-2 


-1 


1.732 


2 


true 


1 


2.037 


0.4633 


4 


-1 


-0.5 


1.936 


2 


true 


1 


2.037 


0.3227 


4 








2 


2 


true 


1 


2.037 


0.9633 


4 


1 


0.5 


1.936 


2 


true 


1 


2.037 


0.3227 


4 


2 


1 


1.732 


2 


true 


1 


2.037 


0.4633 


4 


3 


1.5 


1.323 


2 


true 


1 


2.037 


0.9164 



Table 6.2. Upper bound inclusion value(rj) G r 2tu_1 y checked for "problematic 
values" of |r| and w, cf. ([d} of Proposition 6.1 on page 15 The dependence of p, 
q and r is given by r 2 — pr + q = 0. We have p l < 4g, since r is assumed to be 
imaginary quadratic. 



The following two statements are equivalent: 

(1) There is an I € N 0; such that for all £ € NAF°/ with non-zero most significant digit the 
condition 

|value(OI > Wr'fu 

is fulfilled. 

(2) There exists av>Q, such that for all "d G NAF^,'°° with non-zero most significant digit 
the condition 

|value(0)| > Irf 1 ^. 

holds. 
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Q= \t\ A 

3 1 1 


P 


Rc(t) 


Im(r) 


w 


/c found? 


k 


ii j 


£ 


valid for I < kl 


2 


-2 


-1 


1 


2 


true 


10 


0.1909 


0.03003 


true 


2 


-1 


-0.5 


1.323 


2 


true 


7 


0.5401 


0.138 


true 


2 








1.414 


2 


true 


8 


0.3819 


0.1484 


true 


2 


1 


0.5 


1.323 


2 


true 


7 


0.5401 


0.138 


true 


2 


2 


1 


1 


2 


true 


9 


0.27 


0.03933 


true 


2 


-2 


-1 


1 


3 


true 


4 


1.671 


0.2737 


true 


2 


-1 


-0.5 


1.323 


3 


true 


4 


1.671 


0.2682 


true 


2 








1.414 


3 


true 


4 


1.671 


0.0969 


true 


2 


1 


0.5 


1.323 


3 


true 


4 


1.671 


0.2682 


true 


2 


2 


1 


1 


3 


true 


4 


1.671 


0.2737 


true 


3 


-3 


-1.5 


0.866 


2 


true 


3 


1.323 


0.5054 


true 


3 


-2 


-1 


1.414 


2 


true 


3 


1.323 


0.04922 


true 


3 


-1 


-0.5 


1.658 


2 


true 


4 


0.7638 


0.4729 


true 


3 








1.732 


2 


true 


3 


1.323 


0.5054 


true 


3 


1 


0.5 


1.658 


2 


true 


4 


0.7638 


0.4729 


true 


3 


2 


1 


1.414 


2 


true 


3 


1.323 


0.04922 


true 


3 


3 


1.5 


0.866 


2 


true 


3 


1.323 


0.5054 


true 


4 


-3 


-1.5 


1.323 


2 


true 


2 


2.037 


0.9164 


true 


4 


-2 


-1 


1.732 


2 


true 


2 


2.037 


0.4633 


true 


4 


-1 


-0.5 


1.936 


2 


true 


2 


2.037 


0.3227 


true 


4 








2 


2 


true 


2 


2.037 


0.9633 


true 


4 


1 


0.5 


1.936 


2 


true 


2 


2.037 


0.3227 


true 


4 


2 


1 


1.732 


2 


true 


2 


2.037 


0.4633 


true 


4 


3 


1.5 


1.323 


2 


true 


2 


2.037 


0.9164 


true 



■ m) 



e V c 



Table 6.3. Upper bound inclusion value(?7i 

for "problematic values" of |r| and w, cf. je]) of Proposition |6.1 on page 15 
dependence of p, q and r is given by r 2 
is assumed to be imaginary quadratic. 



V checked 



PT 



0. 



The 

We have p l < 4q, since r 



(b) Letrje NAF°-°° with non-zero most significant digit. Then 

|value(r7)| > {rf 1 f L 

with fi, = vifv>Q, where 



T C V 



1 



Ifv<®i see Table 6.1 on the preceding page, then we set fi, = v from Table 6.4 on page 21 



Proof of Proposition \ 6. 2\ (a) We have to prove both directions. 
|7p =>■ Suppose there exists such an I g No- We set 



v = nun 



in{|r| (|value(OI - IrpVt/) : £ € NAF^ with £_ x ^ o} 



Then clearly v > 0. Using (Jaj) of Proposition 6.1 on page 15 with digits shifted £ to the 
right, i.e., multiplication by t~ 1 , the desired result follows by using the triangle inequality. 
© == *' OF" N° w su PP ose there exists such a lower bound v > 0. Then there is an i £ No 
such that \t\~ fu < Irp 1 ?. Since 

|value(0.?7_i . . .77_ £ )| > \t\~ 1 v> \t\~ 1 f v 

for all w-NAFs 0.?7_i . . . r)-t, the statement follows. 
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Figure 6.1. Lower bound for r = ^ + ^^—11 and w = 2. The procedure stopped 

at I = 6. The large circle has radius \t\~ 1 fu, the small circle is our lower bound 
with radius Jl = v. The dot inside represents zero. The grey region has most 
significant digit zero, the black ones non-zero. 



(b) Set 



M := t w value(ry) = ^t^ 1 + ^ r}-^ 
Since 77 1 7^ 0, we can rewrite this to get 



i=2 



M = f]_ X T 



W — l 



J2 

i=w-\-l 



iT «,-i = v _ lT ™-i + J- v „ {w+k) T- k . 

k=l 



Now consider the Voronoi cell V n _ 1 for ?7_i and Vq = V for 0. Since ?7_i 7^ 0, these two are 
disjoint, except parts of the boundary, if they are adjacent. 
We know from Q of Proposition 6.1 on page 15 that 



t-w 



M - tmt™- 1 = J2 V- {w+k )T- k e (J B[z,\r\- w f L 

zer w-X V 



k = l 



so 



Me |J B(z,\T\- w h 



This means that M is in t' w M 

Now we are looking at t w ~ 1 Vq and using Proposition 3.5 on page 6 from which we know 



L V r] _ 1 or in a |r I w /[/-strip around this cell. 



that b(q, I \t\ w is inside such a Voronoi cell. Thus, we get 

fu 



1 



1 



I \W—1 

T ^ 



2 1 1 j _ | r |_ to , , 

for our lower bound of M and therefore, by multiplying with t~ w one for value^). 



Looking in Table 6.1 on page 18 we see that there are some values where v is not positive. 
As in Proposition 6.1 on page 15 this is the case, if w = 2 and |r| is y/2, v3 or v4 ; and if 
w = 3 and |t| = y2. Since v is monotonic increasing with |t| and monotonic increasing with 
w, there are no other non-positive values of v than the above mentioned. 

For those finite many problem cases, we use ([a| to find a T>. The results are listed in 
Table [6^4 on the facing page| and an example is drawn in Figure [6~T| □ 
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q = \rf 




Re(r) 


Im(r) 


w 






V 


logi_i (ful v ) 


2 


-2 


-1 


1 


2 


9 


0.135 


0.004739 


18.66 


2 


-1 


-0.5 


1.323 


2 


7 


0.27 


0.105 


9.726 


2 








1.414 


2 


8 


0.1909 


0.07422 


10.73 


2 


1 


0.5 


1.323 


2 


7 


0.27 


0.105 


9.726 


2 


2 


1 


1 


2 


9 


0.135 


0.04176 


12.39 


2 


-2 


-1 


1 


3 


6 


0.4177 


0.1126 


9.782 


2 


-1 


-0.5 


1.323 


3 


6 


0.4177 


0.04999 


12.13 


2 








1.414 


3 


6 


0.4177 


0.0153 


15.54 


2 


1 


0.5 


1.323 


3 


6 


0.4177 


0.04999 


12.13 


2 


2 


1 


1 


3 


6 


0.4177 


0.1126 


9.782 


3 


-3 


-1.5 


0.866 


2 


4 


0.3819 


0.003019 


12.81 


3 


-2 


-1 


1.414 


2 


5 


0.2205 


0.04402 


7.933 


3 


-1 


-0.5 


1.658 


2 


5 


0.2205 


0.08717 


6.689 


3 








1.732 


2 


4 


0.3819 


0.003019 


12.81 


3 


1 


0.5 


1.658 


2 


5 


0.2205 


0.08717 


6.689 


3 


2 


1 


1.414 


2 


5 


0.2205 


0.04402 


7.933 


3 


3 


1.5 


0.866 


2 


4 


0.3819 


0.003019 


12.81 


4 


-3 


-1.5 


1.323 


2 


4 


0.2546 


0.07613 


5.742 


4 


-2 


-1 


1.732 


2 


5 


0.1273 


0.03807 


6.742 


4 


-1 


-0.5 


1.936 


2 


4 


0.2546 


0.0516 


6.303 


4 








2 


2 


5 


0.1273 


0.07035 


5.856 


4 


1 


0.5 


1.936 


2 


4 


0.2546 


0.0516 


6.303 


4 


2 


1 


1.732 


2 


5 


0.1273 


0.0467 


6.447 


4 


3 


1.5 


1.323 


2 


4 


0.2546 


0.07613 


5.742 



Tabl e 6.4. Lower bo unds for "problematic values" of |t| and w, cf. ([b]) of Propo- 
sition 6.2 on page 17 The dependence of p, q and r is given by r 2 — pr + q = 0. 



We have p < 4g, since r is assumed to be imaginary quadratic. 



Again, as in the proof of Proposition 6.2 on page 17 the check of the "problematic cases" 
depends on the choice of the digit set T>, cf. Remark 4.6 on page 10| And again, the results stay 
true for any choice of T>. 

Combining the previous two Propositions leads to the following corollary, which gives an upper 
and a lower bound for the absolute value of a w-NAF by looking at the largest non-zero index. 

Corollary 6.3 (Bounds for the Value). Let rj e NAFj"'°°, then we get 

d NAF (v, 0) f L < |value(77)| < d NAF (r7, 0) f v |r| . 



Proof. Follows directly from Proposition 6.1 on page 15 and Proposition 6.2 on page 17 



□ 



Last in this section, we want to find out, if there are special ui-NAFs, for which we know for 
sure that all their expansions start with a certain finite w-NAF. We will show the following lemma. 

Lemma 6.4. Let 

k > k = max {19, 2w + 5} , 
let r\ G NAFjJ; 00 start with the word k , i.e., r\^\ =0, . . . , rj-k = 0, and set z = valued). Then 



O.oo 



we get for all | e NAF* 00 that z = value(£) implies £ G NAF 

Proof. L et £/.£ F e NAF^ n "°°. Then |value(£/.£ F )| < f L implies £j = cf. Proposition 
page 17 For our rj we obtain z = |value(?7)| < |t| k fu, cf. Proposition 6.1 on page 15 



6.2 on 



So we 



have to show that 



\r\- k fu <h, 
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which is equivalent to 

* > l ° g ^ h_ 

For the "non-problematic cases", cf. Propositions |6.1 on page T5] and |6.2 on page 17| we obtain 

k > 2w - 1 + log| r | A 

with 

a- 1 ^ cv -^r- 1 iV%o 

where we just inserted the formulas for fu, fi, and v, and used v > 0. 
Consider the partial derivation of logi T i A with respect to |r|. We get 

dlog M A i \r\ w -l dA 

— — = v - — < 

d\r\ log e |r| |t|cv d\r\ 




where we used |r| > 1, w > 2, and the fact that the quotient of polynomials ^j^ 1 is monotonic 
increasing with |r|. Further we see that A is monotonic decreasing with w, therefore log| r | A, too. 

For |t| = a/5 and m = 2we get log| T | A = 5.84522, for |r| = and w = 3 we get log| T | A = 
1.70649, and for |t| = \/2 and w = 4 we get log| r | A — 2.57248. Using the monotonicity from 

above yields k > 2w + 5 for the "non-problematic cases" 

, /i 
'M 7 

|page| Therefore we obtain A: > 19. L 



For our "problematic cases", the value of logi r i fy- is calculated in Table 6.4 on the preceding 



7. Numeral Systems with Non- Adjacent Forms 

Let t € C be an algebraic integer, imaginary quadratic. Suppose that |r| > 1. Let w € N with 
w > 2. Further let I? be a minimal norm representatives digit set modulo t w as in Definition |4. 5 1 
|on page TP} 

We are now able to show that in this setting, the digit set of minimal norm representatives is 
indeed a width-w non-adjacent digit set. This is then extended to infinite fractional expansions of 
elements in (D. 

Theorem 7.1 (Existence and Uniqueness Theorem concerning Lattice Points). For each lattice 
point z £ Wi[t] there is a unique element £ G NAF^J 1 , such that z = value(^). Thus T> is a width-w 
non-adjacent digit set. The w-NAF £ can be calculated using Algorithm \7.1 on the facing page] 
i.e., this algorithm terminates and is correct. 

The uniqueness result is well known. The existence result is only known for special r and w. 
For example in Koblitz [TS] the case r = ±| + i\/-3 and w = 2 was shown. There the digit 
set V consists of and powers of primitive sixth roots of unity. Blake, Kumar Murty and Xu [4] 
generalised that for w > 2. Another example is given in Solinas [2D]. There r = ±± + and 



"2 1 2 

w = 2 is used, and the digit set V consists of and ±1. This result was generalised by Blake, 
Kumar Murty and Xu for w > 2. The cases r = 1 + \f— 1, r = V—2 and r = h + ^—11 were 
studied in Blake, Kumar Murty and Xu [6]. 



The proof follows a similar idea as in Section 6 on page 15 and in Matula [TDJ. There are 
again two parts, one analytic part for all but finitely many cases, and the other, which proves the 
remaining by the help of a simple procedure. 



Proof. First we show that the algorithm terminates. Let y G S[t] and consider Algorithm 7.1 on 



tF> 1. 



the facing page in cycle I. If r | y, then in the next step the norm \y\ 2 G N becomes smaller since 
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Algorithm 7.1 Algorithm to calculate a w- NAF | e NAF f ; for an element z e 7L[t\. 

1:^^-0 
2: y <- Z 

3: while y ^ do 
4: if t | y then 

5: & <- 

6: else 

7: Let £g <G T> such that £,£ = y (mod r 10 ) 

8: y-^iv- &) /r 

9: + l 

10: £<- ■■■Co 

11: return £ 



Let rjy. If \y\ < \ \t\ w , then y eD, cf. Proposition 3.5 on page 6 and Remark 4.7 on page 10 
Thus the algorithm terminates in the next cycle. If 



we obtain 



which is equivalent to 



So if the condition 



1*1 > 



\y\ \r\ w > \y\ 



\T\ Cy 

1 - \t\- 



T Cy 



\r\ w+1 c v >\y\ + \^\>\y- 



y-it 



< i/l 



I \W + 1 

\T\ Cy 



- 1 



< 



T Cy 



- 1 



>o, 



with the same v as in Proposition 6.2 on page 17 is fulfilled, the norm |y| € Nq is descending 



and therefore the algorithm terminating. 

Now we consider the case, when v < 0. According to Table [67l on page 18| there are the same 
finitely many combinations of r and w to check as in Proposition 6.1 on page 15 and Proposition|6.2 



on page 17 For each of them, there is only a finite number of elements y G Z[t] with 



\y\< 



I iiu-l-l 
T Cy 



so altogether only finitely many y € Z[r] left to check, whether they admit a w-NAF or not. The 
results can be found in the table available as online-resource]^] Every element that was to check, 
has a w-NAF. 



To show the correctness, again let y G Z[t] and consider Algorithm 7.1 in cycle i. If r divides 
y, then we append a digit ^ = 0. Otherwise y is congruent to a non-zero element ^ of T> modulo 
t w , since the digit set T> was constructed in that way, cf . Definitions |4.1| and |4.5| The digit ^ 
is appended. Because t w divides y — £e, the next w — 1 digits will be zero. Therefore a correct 
w-NAF is produced. 

For the uniqueness let £ e NAF f j be an expansions for the element z € S[r]. If r | z, then 

= z = value(^) = £o (mod r), 

so t | £ £ £>■ Therefore £o = 0. If r { z, then r { £o and so £o 7^ 0- This implies £1 =0, . . . , 
= 0. This means £0 lies in the same residue class modulo t w as exactly one non-zero digit of 



V (per construction of the digit set, cf. Definitions 4.1 and 4.5), hence they are equal. Induction 
finishes the proof of the uniqueness. □ 



^Table available at 



www . danielkrenn . at /wnaf -analysis 
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The existence check of the "problematic cases" depends on the choice of the digit set 2?, cf. 
Remark |4. 6 on page 10| but for all possible choices the result stays true. 

So we get that all elements of our lattice Z[t] have a unique expansion. Now we want to get 
a step further and look at all elements of <D. We will need the following three lemmata, to prove 
that every element of (D has a iu-NAF-expansion. 

Lemma 7.2. The function value| NAF fi„.f,n is injective. 

Proof. Let rj and £ be elements of NAFj, n ' '" with value(r/) = value(£). This implies that 
T J value(rj) = T ,7 value(£) G Z[r] for some J G TL. By uniqueness of the integer w-NAFs, see 
Theorem |7.1 on page 22[ we conclude that r\ = □ 

Lemma 7.3. We have value(NAF* n - fin ) = S[l/r]. 

Proof. Let r) G NAF f J' fm and rjj = for all \j\ > J for some J > 1. Then r' valuefa) G Z[r], 
which implies that there are some o, S such that 

value(ry) = aT- {J - 1] + for"' 7 G S[l/r]. 

Conversely, if 

J 



7.1 on 



we have t j z G S[r]. Since every element of S[r] admits an integer w-NAF, see Theorem 
page 22[ there is an £ G NAF^'" with value(£) = z. □ 



Lemma 7.4. %\l/r\ is dense in (D. 

Proof. Let z G (D and X > 0. Then t k z = it + ur for some reals u and u. We have 

\u\ + [v\ T 



1 

< - 



\ K 

T 



which proves the lemma. □ 

Now we can prove the following theorem. 

Theorem 7.5 (Existence Theorem concerning (D). Let z G <D. T/ien t/iere is an rj £ NAFJ' 00 
smc/i t/iat z = value(r7), i.e., eac/i complex number has a w-NAF- expansion. 



Proof. By Lemma [7.4| there is a sequence z„ G Wi[1/t] converging to z. By Lemma 7.3 th ere 
is a sequence r] n G NAF^ n,fln with value(r7„) = z„ for all n. By Corollary 6.3 on page 21 



the 



sequence d|\iAF( T 7n ) 0) is bounded from above, so there is an i such that rj n G NAFf^C NAF^°°. 
By Proposition |4. 10 on page 11 we conclude that there is a convergent subsequence r/' n of r/ n . 



Set rj := lim„_j. 00 rj' n . By continuity of value, see Proposition 4.9 on page 11 we conclude that 



value(?7) = z. □ 

8. The Fundamental Domain 

Let r G (D be an algebraic integer, imaginary quadratic. Suppose that |r| > 1. Let w G N with 
w > 2. Further let I? be a minimal norm representatives digit set modulo t w as in Definition |4. 5 1 
|on page TP] 

We now derive properties of the Fundamental Domain, i.e., the set of complex numbers repre- 
sentable by w-NAFs which vanish left of the r-point. The boundary of the fundamental domain 
is shown to correspond to complex numbers which admit more than one w-NAF differing left of 
the T-point. Finally, an upper bound for the Hausdorff dimension of the boundary is derived. 

Definition 8.1 (Fundamental Domain). The set 

T := value(NAF°-°°) = {value® : I G NAF"'°° } . 

is called fundamental domain. 
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The pictures in Figure [l 0.1 on page 34| can also be reinterpreted as fundamental domains for the 
t and w given there. The definition of the fundamental domain for a general r G (D and a general 
finite digit set containing zero is meaningful, too. The same is true for following proposition, which 
is also valid for general r G <C and a general finite digit set including zero. 

Proposition 8.2. The fundamental domain J- is compact. 



Proof. The set NAF°'°° is compact, cf. Proposition 4.10 on page 11 The compactness of the 



fundamental domain T follows, since T is the image of NAF^°° under the continuous function 



value, cf. Proposition 4.9 on page 11 □ 



6.3 



we obtain 



We can also compute the Lebesgue measure of the fundamental domain. This result can be 
found in Remark |10.3 on page 37| We will need the results of Sections [9] and [10] for calculating 

Next we want to get more properties of the fundamental domain. We will need the following 
proposition, which will be extended in Proposition |8. 7 on the next page] 

Proposition 8.3. Let z G T . If there exists a w- NAF £ 7 .£ F G NAF* n -°° with ^ and such 
that z = value(£/.£ F ) ; then z G dJ- . 

Proof. Assume that z G int T . Then there is an e z > such that B(z,e z ) C int J- . Let e z be 
small enough such that there exists aye B(z,e z ) C S[l/r] and a t? = #/.i9 F G NAF^ n,fln with 
y = value(i9) and such that ^ 0. Let k be the right-length of 

Choose < e y < r^ k ^ w f L such that B(y,e y ) C int J". Since y G J 7 there is an 77 E NAF° ,oc 
with y = value(r7). Therefore, there is a y' G B(y,s y ) n 7L\\./t\ with y' = value^') for some 
V = 'H'i-'H'f e NAF^ n - fin with ^ = (by "cutting" the infinite right side of 77). 

As y' - y G Z[l/r], there is a £ G NAF^ n - fin with value(£) =y'-y. By Corollary[' 
<Inaf(£, 0) < e y /f L < r- k ~ w . Thus & = for all i > —k — (w — 1). 

Now y' = y + (y' - y) and we get a 1?' = G NAF f ^ n - fm with value(ii') = y' by digit-wise 

addition of i3 and £. Note that at each index at most one summand (digit) is non-zero and that 
the ui-NAF-condition is fulfilled. We have 'd'j 7^ 0, since i9/ 7^ 0. 

So we got two different w-NAFs in NAF^ n ' fm for one element y' G S[l/r], which is impossible 
due to uniqueness, see Lemma [7. 2 on the facing page| Thus we have a contradiction. □ 

The complex plane has a tiling property with respect to the fundamental domain. This fact is 
stated in the following corollary to Theorem |7.1 on page 22| and Theorem |7.5 on the facing pagc| 

Corollary 8.4 (Tiling Property). The complex plane can be tiled with scaled versions of the 
fundamental domain J 7 . Only finitely many different size are needed. More precisely: Let K G TL, 
then 

<D = (J (r k value(£) + T k ~ w+1 J 7 ) , 

ke{K,K+l,...,K+w-l} 

$6Naf'; 

k ^ K + w — 1 implies £o 7^ 

and the intersection of two different r k value(£) + T k - w + 1 j^ a nd r k ~ w + 1 value(£') + r k T in this 
union is a subset of the intersection of their boundaries. 

Later, after Proposition |8. 8 on page 27\ we will know that the intersection of the two different 
sets of the tiling in the previous corollary has Lebesgue measure 0. 

Proof of Cor pilar y \8.4\ Let z G <C. Then, according to Theorem |7. 5 on the facing page} there is 
a q G NAF f j-°° with z = value(r7). We look at the block rjK+w-i ■ ■ ■ Vk+iVk- If this block is 0, 
then set k = K + w — 1, otherwise there is at most one non-zero digit in it, which we call ry^. So 
the digits fjfc-i, . . . , r)k~ w +i are always zero. We set £ = . . . r/k+iVk-O ■ ■ • , and we obtain 

z-r fe value(£) G r k - w+1 F. 

Now set F = r k value(£) + T k ~ w+1 J 7 and F' = r k ' value(£') + T k '- W+1 T in a way that both arc 
in the union of the tiling with {k, £) ^ (&',£') and consider their intersection /. Since every point 
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in there has two different representations per construction, we conclude that / C dF and I C OF' 
by Proposition |8. 3 on the previous page| □ 

Remark 8.5 (Iterated Function System). Let t G (D and V be a general finite digit set containing 
zero. We have two possibilities building the elements £ G NAF^'°° from left to right. We can cither 
append 0, what corresponds to a division through r, so we define fo(z) = ^. Or we can append a 
non-zero digit -d G V* and then add w — 1 zeros. In this case, we define f§{z) — - + -4r. Thus we 
get the iterated function system (/W)^ e x> ' Edgar [5] or Barnsley [5J- All are similarities, and 
the iterated function system realizes the ratio list (r$)$ eT) with ro = |r| 1 and for i3 G T)* with 
r-d = \t\ , i.e., we have contracting similarities. So our set can be rewritten as 

^=U/^) = ^ U U + 

Furthermore, if we have an imaginary quadratic algebraic integer r and a minimal norm rep- 
resentatives digit set, the iterated function system (ftf)# eV fulfils Moran's open set conditio?^ cf. 
Edgar 8 J or Barnsley [3]. The Moran open set used is int F. This set satisfies 

/^(int J-)nZ^(intJ-) = 

for i) ^ i)' £ P and 

int F 3 f$ (int J 7 ) 

for all i) E T). We remark that the first condition follows directly from the tiling property in 
Corollary |8.4 on the preceding page with K = — 1. The second condition follows from the fact 



that is an open mapping. 

Now we want to have a look at a special case. 

Remark 8.6 (Koch snowflake). Let r = § + 1^—3 and w = 2. Then our digit set consists of 
and powers of primitive sixth roots of unity, i.e., T> = {0} U {C k '■ k G No with < k < 6} with 
C = e"/ 3 , cf. Koblitz [15]. 
We get 

u 

0</c<6 v 

Since the digit set is invariant with respect to multiplication by i.e., rotation by ^, the same is 
true for F. Using this and r = y/ie™/ 6 yields 



itt/2 / ikir/3+iir/2 i 



^ o<T<6V V3 3^ 



This is an iterated function system of the Koch snowflak^ it is drawn in Figure 10. Ic on page 34 



Next we want to have a look at the Hausdorff dimension of the boundary of F '. We will need 
the following characterisation of the boundary, which is an extension to Proposition |8.3 on thc| 
[preceding page| 

Proposition 8.7 (Characterisation of the Boundary). Let z G F. Then z G dF if and only if 
there exists a w-NAF G NAF5, n,1)0 with £j ^ 0, such that z = value(£/.£ F )- 

Proof. Let z G dF. For every e > 0, there is a y G B(z,e), such that y <=£ F. Thus we have a 
sequence (yj)j >1 converging to z, where the yj are not in F. Therefore each yj has a w-NAF- 

representation rjj G NAF* n '°° with non-zero integer part. Now we will use the tiling property 
stated in Corollary |8. 4 on the previous pagc| The fundamental domain F can be surrounded by 
only finitely many scaled versions of F. So there is a subsequence (i9j)^. gNo of (ilj)j^ with fixed 



4 "Moran's open set condition" is sometimes just called "open set condition" 

^The fact that the Koch snowflake has the mentioned iterated function system seems to be commonly known, 
although we were not able to find a reference, where this statement is proved. Any hints are welcome. 
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Figure 8.1. Automaton A recognising (JjeN Uj f rorn right to left, see proof of 
Proposition |8.8| The state iS is the starting state, all states are valid end states. 
An edges marked with ^ means one edge for each non-zero digit in the digit set 
D. The state ^ means that there was an non-zero digit read, a state e means 
that I zeros have been read. 



integer part ^ 0. Due to compactness of J 7 , cf. Proposition |8. 2 on page 25] we find a £ 
with value z as limit of a converging subsequence of (i^j)jgNo' 

The other direction is just Proposition 8.3 on page 25| thus the proof is finished. 



□ 



The following proposition deals with the Hausdorff dimension of the boundary of J- ' . 



Proposition 8.8. For the Hausdorff dimension of the boundary of the fundamental domain we 
get dim// dT < 2. 

The idea of this proof is similar to a proof in Heuberger and Prodinger |12j . 
Proof. Set k := ko + i 



1 with fco from Lemma 6.4 on page 21 For j G N define 



Uj := {£ G NAF°-' : 



(t+i) ■ ■ 



. C-(£+ fc -i) ^ fc for all I with 1 < I < j - k + 1} 



The elements of Uj — more precisely the digits from index —1 to —j — can be described by the 
regular expression 



tti-2 



fe-i 



h+EE^ E E o £d 

V dev' e=a ) \dev t=w-i 
This can be translated to the generating function 

/ iu— 2 \ 




G(Z) 



E 



1 



1 



^=0 / " Zj^=«;-1 

used for counting the number of elements in L^ . Rewriting yields 

1 - Z k 1 + (#£>* - 1)Z - ^'Z" 1 




G(Z) 



and we set 

Now we define 



1 - Z I- Z - jfVZ w + #£>»Z fc + 1 ' 
q(Z) :=1-Z- #VZ W + #VZ k+1 . 



Uj := {£ G CTj : ^ ^ 0} 

and consider U := UjeN ^i' ^ ne ^-NAFs in this set — more precisely the finite strings from index 
— 1 to the index of the largest non-zero digit — will be recognised by the automaton A which reads 
its input from right to left, see Figure [8~T] It is easy to see that the underlying directed graph 
of the automaton A is strongly connected, therefore its adjacency matrix is irreducible. Since 
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there are cycles of length w and w + 1 in the graph and gcd(iu, w + 1) = I, the adjacency matrix 
is primitive. Thus, using the Perron-Frobenius theorem we obtain 

JfUj = # (walks in Ga of length j from starting state S to some other state) 
= (1 ... 0)M* A (:l =?(a|r| 2 ) J (l + 0(^)) 
forac>0, aer>0, and an s with < s < 1. Since the number of w-NAFs of length j is 



0^|r| 2 "'^, see Theorem 
We clearly have 



5.1 on page 12 



we get a < 1. 



Uj = y u t , 

e=j-k+i 

so we get 

#17, = [Zi] G(Z) = c (a |r| 2 ) J (l + 0{j)) 

for some constant c > 0. 

To rule out a = 1, we insert the "zero" |r| 2 in We obtain 

(/(VP 2 ) = 1 - \t\- 2 - #£>' Irf 2 "' + #2?' |rr 2(fe+1) 

= i _ i T r 2 _ i-H 2 ^- 1 ) ( \ T \ 2 _ i") i r r 2lu x ui 2 ^- 1 ) f u 1 _ i \ - + 1 ; 



(M 2 -i) 



+W ^-1)( M »_ 1 ) w - 



r| 2( W - fc -2) > 



where we used the cardinality of T>* from Lemma 4.3 on page 9 and |r| > 1. Therefore we get 
a < 1. 
Define 

[/ := {value® : I G NAF°;°° with • ■ • ^ fe for all I > l} . 

We want to cover [7 with squares. Let iS be the closed paraxial square with centre and width 2. 
Using Proposition |6.1 on page 15] yields 

U C |J (* + |rp 5) 

zGvalue([/j) 

for all j € N, i.e., £7 can be covered with boxes of size 2/;/ |Tp' 7 . Thus we get for the upper 
box dimension, cf. Edgar [5], 

dim B L7 < hm l0g# ^ . . 

^°o-log(2/a|r| J ) 

Inserting the cardinality #t/j from above, using the logarithm to base |r| and < s < 1 yields 

^- TT<V logM C + jlogM(^M 2 ) + log M (l + 0(^)) 

dim B [7 < .lrm = 2 + log M a. 

Since cr < 1, we get dim B J7 < 2. 

Now we will show that dJ 7 C [7. Clearly [/ C J, so the previous inclusion is equivalent to 
T \ U C int(J"). So let z G J" \ [7. Then there is a £ G NAF°'°° such that z = value(|) and £ 
has a block of at least k zeros somewhere on the right hand side of the r-point. Let t denote the 
starting index of this block, i.e., 

£ = 0. £-1 . . . £-(£-1) X-(i+k)i- (e+k+i) ■ ■ ■ ■ 

S v ' 

Let i9 = tii.tiAti-eti-it+i) • ■ • G NAFt n -°° with value(tf) = z. We have 

z = value(0.£ A ) + r^"^ = value(tfj.0 A ) + t~ 1 ~ w z § 
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for appropriate z% and zq. By Lemma 6.4 on page 21 all expansions of z^ are in NAF°°°°. Thus 
all expansions of 



T-^-^Zt 



value(i9/i? A ) + t - ^ -1 ^ - value(^) = t 1 ~ x z - value(^) 

start with O.O™ -1 , since our choice of k is fco+w— 1. As the unique NAF of value(i9/i9 7 i) — value(^yi) 
concatenated with any NAF of r - ^ -1 ^ gives rise to such an expansion, we conclude that 
value(i9/i?A) — value(^) = and therefore = and i?^ = £4. So we conclude that all 
representations of 2 as a w-NAF have to be of the form O.^aO 1 " -1 ^ for some iy-NAF 77. Thus, by 
using Proposition |8. 7 on page 26 we get z ^ d J- and therefore z € in.t(.F). 
Until now we have proved 

dimsdJ 7 < dim bU < 2. 

Because the Hausdorff dimension of a set is at most its upper box dimension, cf. Edgar [5] again, 
the desired result follows. □ 

9. Cell Rounding Operations 

Let t € C be an algebraic integer, imaginary quadratic. In this section, we define operators 
working on subsets (regions) of the complex plane. These will use the lattice Z[r] and the Voronoi 
cells defined in Section [3j They will be a very useful concept to prove Theorem 1 1 1 . 1 on page 38| 

Definition 9.1 (Cell Rounding Operations). Let B C <D and j £ R. We define the cell packing 
of B ("floor B") 



l B \0--= U V * 

z6S[t] 
V Z <ZB 

the cell covering of B ("ceil B") 



and 



JO' 



the fractional cells of B 

{B} :=B\[B\ Q 
the cell covering of the boundary of B 

d(B) := \B] Q \ [B\ Q 
the cell covering of the lattice points inside B 

L^lo := (J V > 
zesnz[r] 



and 



and 



and 



and 



\ B ~\ 



0,; 



\r j B] 



O- 



= - {t>B\ 



O ■ 



o 



#(J?) 0j := #(W 



O 



and the number of lattice points inside B as 

#(B) :=#(BnS[r]) and 

To get a slight feeling what those operators do, have a look at Figure [9. 1 on the following page} 
There brief examples are given. For the cell covering of a set B an alternative, perhaps more 
intuitive description can be given by 

\B] := |J V z . 

The following proposition deals with some basic properties that will be helpful, when working 
with those operators. 

Proposition 9.2 (Basic Properties of Cell Rounding Operations). Let BCC and j g R. 
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(a) We have the inclusions 

\B\ 0d QBQBQ\B\ 0ij (9.1a) 

and 

\B\ O jQ\B\ 0ti Cfflloj- (9-lb) 

For B' CC with BCB' we get [B\ Qj C L^'Joj, L^loj ^ L^'loj anrf ^0,j ^ ^'l 0j ' 
i.e., monotonicity with respect to inclusion 

(b) The inclusion 

{B} 0J C 9(B) j (9.2) 

holds. 

(c) dB C 5(B) 0j . and /or eac/i ceZ^ V' m <9(5) Q ^ we /iaue V n 9-B 7^ 0. 

(d) For B' C (D wii/i 2?' disjoint from B, we get 

#(B U S') 0j = #(£)oj + #( B ') 0j , (9-3) 
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and therefore the number of lattice points operation is monotonia with respect to inclusion, 
i.e., for B" C (D with B" C B we have #(S") Q . < #(B) Q .. Further we get 



X([B] 



O.j 



#( s )o, = #(^lo,i) , = l^^p 

Proof, (a) L-^Joi — B follows directly from the definition. Since [B^Jq j — B C '> we S e t 



\B] 0d = [BO^.D( B of = B. 
The inclusion [-BJ o i — L-^l O j f° uows directly from the definitions and [B] q ■ C \B~\ q . 

again by considering the complement, because L^ C lo j = \-B~\o j' Similarly, the monotonicity 
can be shown. 

(b) We have 

{B} 0>j = B \ \B\ 0tj C \B-\ . \ |B| 0j = d{B) 0d . 

(c) We assume j = 0. Using Q yields dB CSC |\B] . Let x G dB. If x <£ B, then [SJq C B 
implies that x ^ [i?J q . So we get 



x e \B] Q \[B\ Q C \B] \ [B\ Q = d(B) Q . 

Now suppose x £ B. Consider all Voronoi cells Vi, i G I, for a suitable finite index set 
/, such that x G Vi. We get x G int(\J i£l Vi) . If all of the Vi are a subset of |_i?J q , then 
x G int(-B), which is a contradiction to x G dB. So there is at least one cell V that is not a 
subset of |_-SJo- Since 



rSlg=LB c jg = int 



/ \ 

U ^ 

V ZmT] c ) 



and a; i? c , V is not in this union of cells. So V is in the complement, i.e., V C [B]q. 
And therefore the statement follows. 

Now we want to show that there is a subset of the boundary in each V-cell V of 3(B)q. 
Assume V'CidB = 0. If V'dB = 0, then V C B c , so 7' is not a subset of \B] Q , contradiction. 
If V' fl B ^ 0, then V' C. B, since V does not contain any boundary. But then, V' C L-^Jo' 
again a contradiction. 

(d) Since the operator just counts the number of lattice points, the first statement follows. 

In the other statement, the first equality follows, because z G BC\7L\t\ ^==^ V z C L-^lo 
holds. Since L-^lo j consists of cells each with area A(t _j V), the second equality is just, after 
multiplying by A(t _3 V), the equality of the areas. □ 

We will need some more properties concerning cardinality. We want to know the number 
of points inside a region after using one of the operators. Especially we are interested in the 
asymptotic behaviour, i.e., if our region becomes scaled very large. The following proposition 
provides information about that. 

Proposition 9.3. Let 5 G R with 6 > 0, and let U C (D bounded, measurable and such that 

#(d(NU) ) Q = o(\N\ s ) (9.5) 

for N G <D. 
(a) We get 



#(INU\ ) = \N\ 2 ^ )+ 0(\N\< 

H\m )o-\ N \ 2 ^r ) +°(\ N \ 5 ) 
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and 



(b) We get 



#(NU) = #([NU] 



0)0 



MU) 

X(V) 



0(\N\' 



#((N + l)U\NU) = o(\N\' 
Proof, (a) Considering the areas yields 

#{[nu\ ) \(v) < x(nu) = |iv| 2 x(u) < #(|Wl )o W > 



since [NU\ Q C NU C \NU] Q , see Proposition 9.2 on page 29 If we use |~iVir| = [NU\ Q U 
3(NU)q, we obtain 

< |Af ^ - #(lWlo) ^ #( 9 ( Arf/ )o) 

Because #(d(NU) ) = o(\N\ s> \ we get 

,2 A(f/) 



N 



X(V) 



o 



and thus the result follows. 

Combining the previous result and Proposition |9. 2 on page 29] proves the other two state- 
ments. 

(b) Let d £ R such that U C B(0, d). Let ye (N + 1)U \ NU. Obviously, this is equivalent to 
y/(N + 1) € U and y/N £ U, so there is a z <G dU on the line from y/N to y/(JV +1). We get 



y_ 

N 



<\y\- 



1 1 

N ~ N+l 



\V\ 

|JV + 1| \N\ ~ \N\' 



and therefore 



(N +1)U\NU C (J 

zed(NU) 



Since the boundary d(NU) can be covered by OniV|*j cells, cf. Q of Proposition 
page 29 and the discs in Uze3(jv;y) ®( z i d) have a fixed size, the result follows. 



9.2 on 

— n 



If the geometry of U is simple, e.g. U is a disc or U is a polygon, then we can check the covering 
condition (9.5) of Proposition 9.3 on the preceding page by means of the following proposition. 

Proposition 9.4. Let U C <D such that the boundary of U consists of finitely many rectifiable 
curves. Then we get 

#{d(NU) ) =O(\N\) 

forNe €. 

Proof. Without loss of generality, we may assume that the boundary of U is a rectifiable curve 
7: [0, L] — > <D, which is parametrised by arc length. For any t G [1/(2 |JV|),i- 1/(2 \N\)}, we 
have 



7 



t - 



1 



t + 



1 



2|7V|' 2|iV| 



1 



2|JV| 



as the straight line from j(t) to j(t') is never longer than the arc-length of j([t,t']). Thus dU 
can be covered by 0(L \N\) discs of radius 1/(2 \N\) and consequently, d(NU) can be covered by 
0(L\N\) discs of radius g. As S[t] is a lattice, each disc with radius \ is contained in at most 
4 Voronoi-cells, cf. Proposition 3.5 on page 6| Therefore, O(N) cells suffice to cover d(NU). □ 
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10. The Characteristic Sets W v 



Let t € C be an algebraic integer, imaginary quadratic. Suppose that |r| > 1. Let aieN with 



w > 2. Furt her let T> be a minimal norm representatives digit set modulo t w as in Definition 4.5 



on page 10 We denote the norm function by N ': S[r] — >■ S, and we simply have |A/"(r)| = |r| 



Again for simplicity we set V* :=V\ {0}. 

In this section we define characteristic sets for a digit at a specified position in the w-NAF 
expansion and prove some basic properties of them. Those will be used in the proof of Theorem |11.1| 
|on page "55} 

Definition 10.1 (Characteristic Sets). Let rj £ V . For j £ No define 

W„j := {valued) : £ e NAF°" i+ ™ with = r,} . 
We call |_Wtj ; j"|q the jth approximation of the characteristic set for n, and we define 

^:={L^1 0j+ 4 s[t] . 

Further we define the characteristic set for rj 

W v := {valued) : £ € NAF°'°° with = r,} . 

and 

W v := {W„} z[t] . 

For j e N we set 

/3, J :=A(LW j; , J l 0j . + J-A(W t ,). 

Note that sometimes the set W v will also be called characteristic set for n, and analogously 
for the set W v j. In Figure 10.1 on the following page some of these characteristic sets — more 
precisely some approximations of the characteristic sets — are shown. The following proposition 
will deal with some properties of those defined sets, 

Proposition 10.2 (Properties of the Characteristic Sets). Let r/ ET>' . 

(a) We have 

(b) The set W v is compact. 

(c) We get 



W v = rjT- w + t- 2w+1 T. 



(d) The set LWjjIqj+ib * s ^deed an approximation ofW v , i.e., we have 



W v = liminf [yV ntj ] j+w = limsup [W V ^ Q +w . 

JEM" J j£N 

(e) We have intW,, C liminf jeNo L^jIq J+u) . 

(f) We get W n - ^t"™ C V, and /or j e N we obtain \ W v ,j\ j+w - W~ w Q V. 

(g) For the Lebesgue measure of the characteristic set we obtain X(W V ) = X(W n ) and for its 

approximation \( lWv,3~\o,j+w) = K W v,i)- 

(h) Let j € N . If j <w-l, then the area of L^»?,jlo,j+tu 



A 



(LW^l ,, +w )=|r|- 2 ^A(F). 



If j — then the area of [Wri,j~\@ 



j+w 



IS 



with e w and p from Theorem \5.1 on page 12\ 
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(a) W v ,j for r 
3 = 11 



7, w = 2 and 





(b) 1%,-; for r = 1 + v^T, id = 4 and j = 11 



• 

* 



*• * 

* 



'::is«i«=is#- 

• • Ut# • • • • • 

• • • 



(c) W v ,j for t 



3, u> = 2 and j = 7 



(d) W, l3 - for r = § + 



-3, ui = 3 and j = 6 



FIGURE 10.1. Characteristic sets W r) . Each figure can either be seen as approxi- 
mation Wjjj for W^, or as values of w-NAFs of length j, where a scaled Voronoi 
cell is drawn for each point. Different colours correspond to the digits 1 and w 
from the left in the w-NAF. They are "marked" whether they are zero or non-zero. 



The area of W„ is 



X(W V )=X(V) e v 



again with e w from Theorem \5.1 on page 1'^ 
Let j e N . We get 

Pr,,j = / - l Wr ,)(x)dx. 

Jxev 

If j < w — 1, then its value is 



find = (l 



r i-2(^)_ 
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If j > w ~ 1 j then we get 

P n , 3 =0{p>). 

Again e w and p can be found in Theorem \5.1 on page 1S\ 

Proof, (a) Is clear, since we have the digit r\ at index — w and an arbitrary w-NAF starting with 
index — 2w. Note that the elements in NAF, ' 00 start with index — 1. 



(b) Follows directly from ([a]), because J- is compact according to Proposition 8.2 on page 25 



(c) Clearly we have W v ,j C W v - Thus U je N W v ,j C W v , and because W v is closed, the inclusion 
UjeNo ^ W »? follows. Now let z G W„, and let £ G NAF°;°°, such that value(£) = z. 
Then there is a sequence of w-NAFs ($e)^ <£ - No with finite right-lengths that converges to £ and 
clearly 

value(&) G |J W„ )fc . 
feeNo 

Since evaluating the value is a continuous function, see Proposition |4. 9 on page lTj we get 



z = value(£) = value! lim & I = lim value(^) £ II W^fc. 

v 7 fee No 

The equality UjeN W v .j = um i^oo W^j is obvious, since W,j is monotonic increasing, 
(d) First we show that we have 

lim sup lW n , 3 ] j+w CW v . 

Let 

« £ lim sup LW^lo^ - fl U LV^,*l 0)fc+to 



Then there is a jo > such that 2 G L^ijjolo j'o+w Further, for je-i there is a j^ > je- 
such that z G l^vdelo h+w ^ or eacn ^ € Nq there is a Z£ G C VV^ with 



< cy |r| |r| 

1— J/— u> 



-jt-w 



sinc e j^gijilOji^b " consls ts of cells |r| 31 V with centres out of W v ,j e - Refer to Proposi- 



tion 



3.5 on page 6 for the constant cy \r\. Thus we get z — lim^oo zi £ W n , since \t\ 31 w 
tends to for large £ and is closed. 

Using the closeness property of W n again yields 



lim sup lW n<j ] 0j+w C W„. 
i->oo 



Now we are ready to show the stated equalities. We obtain 



W v = lim W^.j = liminf W V:j C liminf [W^lr, . C limsup LW^ln 1+™ ^ *%> 



so equality holds everywhere, 
(e) Let z £ intW,,. Then there exists an e > such that B(z,e) C intW^. For each fc G No 
there is a y G T~ k ~' w 7L\r\ with the property that z is in the corresponding Voronoi cell, i.e., 
z £ y + T _fe_u; V. For this y, there is also an £ G NAF f J 1 - fc+u ' such that y = value(£). 

Clearly, if k is large enough, say k > j, we obtain y + r~ k ~ w V C B{z,e). From Proposi- 
tion ; 



3.7 on page 26 (combined with Q) we know that all w-NAFs corresponding to the values 
in int must have 77 at digit — w and integer part 0. But this means that value(£) G W^fc 
and therefore z £ |Wn,felo ^ +w - So we conclude 

z £ |J p| LW„, fc l , fc+w - liminf [W, h3 -\ o+w . 

jSN k>j 



;s<) 
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(f) Each w-NAF £ £ NAF^ ,0 ° corresponding to a value in W v — rjr w starts with 2w — 1 zeros 
from the left. Therefore 

valued) = r 1_2,c valued) 
for an appropriate w-NAF $ £ NAF° - °°. Thus, using value(i?) £ t 2w ^ 1 V from Proposition 



6.1 



|on page 15] the desired inclusion follows. 

The set IW^j'Io j+t« — i] T ^ w £ V consists of cells of type t~^~ w V, where their centres are 
the fractional value of an element £ £ NAF^ +, °. Again the first 2w — 1 digits are zero, so 

valued) = ^"'valueO?) 

for an appropriate w-NAF ■& £ NAF°'- ?_!i,+ . Suppose j > w — 1. Using value(#) + 
T -{j-w+i)y (_ T 2w-iy a g am f rom Proposition 6.1 on page 15 the statement follows. If 
j < w — 1, then value(#) = and it remains to show that r~ d ~ w V C V. But this is clearly 



true, since r V C V according to Proposition 3.5 on page 6 



(g) As a shifted version of the sets W v and L^Hj.j'lo j+w 1S contained in V by Q, so the equality 
of the Lebesgue measures follows directly. 

(h) The set L^n.j'lo j+t« cons ists of of cells of type r~^~ w V, where their centres are the value of 
an element £ £ NAF°'"' + "'. The intersection of two different cells is contained in the boundary 
of the cells, so a set of Lebesgue measure zero. 

Suppose j > w — 1. Since the digit = r\ is fixed, the first 2w — 1 digits from the left 
are fixed, too. The remaining word £_2uj ■ ■ ■ £-(j+io) can be an arbitrary w-NAF of length 



j — w + 1, so there are Cj- w +i tW choices, see Theorem 5.1 on page 12 
Thus we obtain 

A (LW^1 0j+ J = *(r- (w+j) v) = C^ w+1 , w | T |- 2 ^ X(V) . 

Inserting the results of Theorem |5.1 on page 12| yields 

= KV) : —rA \ v +OU J ). 

K ' I 1 2(u;-l) ( (\ ,2 ,\ . -.N VP > 

V\ {{\ T \ -ljw + l 



If j < w — 1, then [WtwIq j+u, consists of only one cell of size t~^~ w V, so the stated result 
follows directly. 

(i) Using ([d]), ([e]) and the continuity of the Lebesgue measure yields 



A(hW [W v ,^ +W j < limmf a(lW, j ] 0) . + J < limsup a(lW j? ,,] 0j+w 
< A I lim sup [Wn,j] , +w ) < A ( lim sup [W^j] ,, 



A(W„) < A(intW^) + A(0W„) 



< A 



Since A(9W^) = 0, combine Q and Proposition 8.8 on page 27 to see this, we have equality 
everywhere, so 



Thus the desired result follows from ([h]), because p < 1. 
(j) Using (|f| and |g]) yields the first statement. The other result follows directly by using (|h|) and 

dH. □ 
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Using the results of the previous proposition, we can finally determine the Lebesgue measure 
of the fundamental domain T defined in Section [8] 

Remark 10.3 (Lebesgue Measure of the Fundamental Domain). We get 



A(J-) = Irl 2 ^- 1 ' e w X(V) = -i 



t\ |Im(r)| 



t\ - l)w + l 



using ([a| and from Proposition 10.2 on page 33 e w from Theorem 5.1 on page 12 and X(V) = 



|Im(r)| from Proposition 3.5 on page 6 



The next lemma makes the connection between the w-NAFs of elements of the lattice 7L [r] and 
the characteristic sets W v j. 

Lemma 10.4. Let r\ £ V, j > 0. Let n £ 7L\t\ and let n G NAF f J be its w-NAF. Then the 
following statements are equivalent: 

(1) The jth digit of n equals r\. 



(2) The condition {i 



£ W Vt j holds. 



(3) The inclusion {T~^ +w ^V n } %[r] C W Vtj holds. 
Proof. Define m by 



m k := 



rik if fc < j + w, 
if fc > j + w 



and m := value(m). Then, by definition, m = n (mod t j+w ), 

( T -Cj-H») n \ = ( T -0+-) m \ 

L J Z[t] I- > 1L{t\ 

and T~v +W >m £ T . As the jth digit of n only depends on the j + w least significant digits of n, 
it is sufficient to show the equivalence of the assertions when n and n are replaced by m and to, 
respectively. 

By definition, rrij — rj is equivalent to T~^ +W 'm £ VVr),j- 

© => Assume now that r-^+^m £ Then m G T^ +w W, hj and 

r-^V m CLW^l 0j+tu . 

This implies {T-^+ w ^V m } z[ , C W}. 
I '3) =>■ | j8). This implication holds trivially. 

So now assume that {r _ ^ +tu ^ m } z r T i G W n j. Thus there is an mf such that 



and 



T -(J'+«o m 



■-0'-H») m ' e e[t]. 



This immediately implies to' G Z[t] and m = m! (mod t- j+ '"'). We also conclude that 
to' G t j+ "' L w >7,ilo,i+iu- As m ' G this is equivalent to to' G r J ' +w W^j and there- 

fore T-^ +w hn' £ W rhj . By definition of W v ,j, there is a O.m' G NAF°; i+u ' such that 
T~V +w 'm' = value(O.m'), i.e., to' = value(m'), and m'j = 77. From to' = to (mod 7-'+'"') 
we conclude that rrij = 77, too. (In fact, one can now easily show that we have m' = m, 
but this is not really needed.) □ 



CLEMENS HEUBERGER. AND DANIEL KRENN 



11. Counting the Occurrences of a non-zero Digit in a Region 
Let t € C be an algebraic integer, imaginary quadratic. Suppose that |r| > 1. Let aieN with 



w > 2. Further let T> be a minimal norm representatives digit set modulo t w as in Definition 4.5 
|on page TO] 

We denote the norm function by Af: TL\r\ — > 7L, and we simply have |A/"(r)| = |t| 2 . We 
write r = |r| e %B for 9 £ (— 7r, 7r]. Further, recall Iverson's notation [eapr] = 1 if expr is true and 
[eipr] = otherwise, cf. Graham, Knuth and Patashnik [IT], and that the Lebesgue measure is 
denoted by A. 

In this section we will prove our main result on the asymptototic number of occurrences of a 
digit in a given region. 

Theorem 11.1 (Counting Theorem). Let ^ n £ V and N e R with N > 0. Further let U C <D 
be measurable with respect to the Lebesgue measure, U C B(0, d) with d finite, i.e., U bounded, and 
set S such that #(<9(-/VC/)q)q = 0(iV 5 ) . Assume 1 < S < 2. We denote the number of occurrences 
of the digit n in all width-w non-adjacent forms with value in the region NU by 

Z T .w.r](N) — [jth digit of z in its w-NAF-expansion equals rj\ . 

Then we get 

Zr, w , n (N) = e w iV 2 A(C/)log |T| 7V + iV 2 ^(log| r | Nj + 0(V log M N) + o(n s log |T| jv) , 

in which the following expressions are used. We have the constant of the expectation 

1 



|r| a <^((|T| a -l) «, + !)' 
cf. Theorem 5.1 on page 12\ Then there is the function 

ip v (x) = iP v ,m(x) + ip v ,v(x) + ip v ,g,{x) , 

where 

%,m( x ) = H u ) (c + 1 - {x}) e w , 

I 1 2(c— {x}) 00 „ 

wrai/i t/ie rotation 9{x) = e ~ l8x - l9c > an d 



We have a — 2 + l°g| T | P < 2, p = ^1 + pp^g J < 1, and 



log| T | d - log| T | /x 

iwi/i the constant f^ of Proposition ^). 2 on page 17\ 

Further, if there is a p £ IN, such that e 2Wp U — U , then ip v is p-periodic and continuous. 

Remark 11.2. Using a disc as region U, e.g. U = B(0, 1), yields that ip v is 1-periodic and continuous 
for all valid r. The reason is that the condition e t0p U = U is then clearly fulfilled for every p, 
especially for p = 1. 

The parameter S is 1 for simple geometries like a disc or a polygon. See Proposition |9.4 on| 
|page 32| for details. 

Remark 11.3. If J = 2 in the theorem, then the statement stays true, but degenerates to 

Z T , W , V (N) = o(iV 2 log |r| 7v) . 
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The proof of Theorem 11.1 on the preceding page follows the ideas used by Delange [7J. By 
Remark |11.3 on the facing page we restrict ourselves to the case S < 2. 

We will use the following abbreviations. We set Z(N) := Z TtW}V (N), and we set W := W n and 
Wj := W vd for our fixed r\ of Theorem |1 1.1 on the preceding page| Further we set j3j : — Pr/. ji 
cf. Proposition 10.2 on page 33 By log we will denote the logarithm to the base |r|, i.e., \ogx = 
log| r | x. These abbreviations will be used throughout the remaining section. 



Proof of Theorem \11.1\ We know from Theorem 7. 1 on page 22 that every element of 7L [r] is 
represented by a unique element of NAF^J 1 . To count the occurrences of the digit r\ in NU, we 
sum up over all lattice points n £ NU (1 7L [t] and for each n over all digits in the corresponding 
w-NAF equal to ij. Thus we get 

Z ( N ) = E E MNAF^HHr,], 

n£NUnZ,[T] j£N 

where Ej denotes the extraction of the jth digit, i.e., for a w-NAF £ we define := £j- The 

inner sum over j £ No is finite, we will choose a large enough upper bound J later in Lemma |l 1.4 
|on page 41| 
Using 



MNAMn)) = r,] = 



from Lemma 10.4 on page 37 yields 



where additionally the order of summation was changed. This enables us to rewrite the sum over 
n as integral 



*w=£ E 



i 



j=0 n£NUnZ[T] 
J 



X(V n ) JxEV, 



l-Wj 



d:r 



V)gJ 6lwv >({^Lj d *- 



We split up the integrals into the ones over NU and others over the remaining region and get 

7 

1 



Z(N) 



E 



KV)- _ JxGNU 



in which ^(N) contains all integrals (with appropriate signs) over regions |_iVC/"| q \ NU and 

M7\[_mt] . 



Substituting x = r J y, dx — |T| 2J dy we obtain 



,2J J 



Z(N) 



X(V) 



E / ^wJ{yr J -^} nT] )dy + T v (N). 



Reversing the order of summation yields 

I ,2J J 



Z(N) 



E 



X(V) f- 



y£r- J NU 



^({yr j - w } z[r] )dy + F v (N). 



40 
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Figure 11.1. Splitting up the region of integration r J NU 



We rewrite this as 



2.7 



A \ v ) Jyer- J NU 



J=0 Jy€ 
|2J J 



\(V) 



With t- j NU = [t~ j NU\ ._ w U {t- j NU} q , see Figure 11.1 for each integral region we 



get 



Z(N) = M V (N) + Z V (N) + V V (N) + Q V (N) + S V (N) + F n {N) 



in which M. n is "The Main Part", see Lemma 11.7 on the next page 
M n (N)^ l ^--(J+l)X(W) f dy, 

A \ v ) Jyer- J NU 



Z v is "The Zero Part", see Lemma 11.8 on page 42| 



,2J J 



^W = Un£/ , , ^w([vr^} nT] )-X(W))dy, 



is "The Periodic Part", see Lemma 11.9 on page 42 



2 J J 

W = tLE / ^w({yr^} nr] )-X(W))dy, (11.1c) 



Q r) is "The Other Part", see Lemma 11.10 on page 44 

I |2J J 



m \ -« 

^• / 3/6L'-- 7 iV!7j 0ij _ 



5,, is "The Small Part", see Lemma 11.11 on page 45 

I |2J J 

5 n (iV) 



(11.1a) 



(11.1b) 



(lur^-lw)^-"}^)^, (H.ld) 



(ll.le) 
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and is "The Fractional Cells Part", see Lemma 11.12 on page 46 

.7 



j=0 Jxe[NU] Q \NU 



1 - 

TV) 51 



Iff,- 



I— ] 

1—1 



d.z: 



(ll.lf) 



da;. 



To complete the proof we have to deal with the choice of J , see Lemma |11.4| as well as with 



each of the parts in (11.1 1, see Lemmata 11.7 



checked in Lemma |1 1.1 3 on page 46 



to 



11.12 



on pages 



41 



46 The continuity of ip^ is 



□ 



Lemma 11.4 (Choosing J). Let N £ R> . Then every w-NAF o/NAFj," with value in NU ho 
at most J + 1 digits, where 

J = [\ogN\ +c 

with 

c = [log d - log f L \ + 1 



with Jl of Proposition \6.2 on page 17 



Proof. Let z £ NU, z^O, with its corresponding w-NAF £ £ NAF f ^ n , and let j £ N be the 
largest index, such that the digit ^ is non-zero. By using Corollary 6.3 on page 21 we conclude 
that 

\r\ j f L < \z\ < Nd. 

This means 

j < logiV + logd-log/i, 

and thus we have 

j < [log N + log d - log f L \ < [log N\ + Llog d - log f L \ + 1. 
Defining the right hand side of this inequality as J finishes the proof. □ 

Remark 11.5. For the parameter used in the region of integration in the proof of Theorem |11.1| 
|on page 3"5| we get 

T->N= \T\ {losN} - c d(\ogN), 
with the rotation 6(x) — e ~ te l x l- iec . I n particular we get |t~ ,7 A| = 0(1). 
Remark 11.6. Let 7 £ R with 7 > 1, then 

7 J = 7V los7 7 c_{logAr} = C(A log7 ) . 



In particular It 



2.7 



0(N 2 ) and |t| j = 0(N). 



Lemma 11.7 (The Main Part). For ( |ll.la ) m i/ie proof of Theorem 11.1 on page 38 we get 

M n (N) = e w N 2 X(U) log N + N 2 ^ hM (log N) 
with a 1-periodic function tpri,M! 

%,M {%) = HU) (c + 1 - {x}) e w 

and 



1 



i2(ui- 



•■>((! 



r - 1 tu + 1 



12 
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Proof. We have 



2.7 



M V (N) = y— (J + 1)X{W) 



X(V) 

As X(t~ j NU) = \t\~ 2J N 2 \(U) we obtai 



yET- J NU 



dy. 



M ri (N)= > ^(J+l)N 2 X(U) 



By taking X(W) — X(V) e w from ^ of Proposition 10.2 on page 33 and J from Lemma 11.4 on 
|thc preceding page] we get 

M V (N) = N 2 X(U) e w (LlogA^J +c+l). 
Finally, the desired result follows by using x = \ x\ + {x}. □ 



Lemma 11.8 (The Zero Part). For (11.1b) in the proof of Theorem 11.1 on page 38 we get 

Z V {N) = 0. 

Proof. Consider the integral 



h 

lyelT--'NU\ 0] 

We can rewrite the region of integration as 



[t- j NU\ 



1 



(l w ({yr^} z[r] )-X(W))dy. 



for some appropriate Tj— W C 7L[t]. Substituting x — t° w y, dx — |r| dy yields 



z£T f - 
2( 3 -w) 



I 



' ' | r |2(j'-«') 



(%(W ZM ) -KW) 



dx. 



We split up the integral and eliminate the fractional part {a^}a[ T ] by translation to get 

I i = rA=^) £ I ^w{x)-\{w))dx. 

\t\ zeT Jxev 



=o 



Thus, for all j £ Nq we obtain Ij = 0, and therefore Z V (N) = 0. 



□ 



Lemma 11.9 (The Periodic Part). For (11.1c) in the proof of Theorem 11.1 on page 38 we get 

V V (N) = N 2 V^p(log TV) + 0(N S ) 

with a function ipn,v, 

, |2(c-{x}) cv 



E 



A ( y ) j=0 Jvz{\t\^-° e(Vx\)u} ] 



(iw({yT>-™} m )-\(W)) dy, 



-ivx—xoc 



with the rotation 9(x) = e 

If there is a p £ N, such that e l9p U = U , then ipr/.v is p-periodic 



Proof. Consider 



lye{T-JNU} ._ 
The region of integration satisfies 



(l w ({yr^} m )-X(W))dy. 



{T- J NU} ._ w Cd(r- J NU) 0i ._ w = : J^ |J V, 



(11.2) 



for some appropriate Tj_ w C 7L\t\ 
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We use the triangle inequality and substitute x — t' } w y, dx = \t\ 



dy in the integral to 



get 



1^1 < 



,2(j-w) 



tw({x} z[T] )-\(W) 



dx. 



<1+\(W) 

After splitting up the integral and using translation to eliminate the fractional part, we get 



1 }l - way-") 



Using #(d(NU) ) = 0(N S ) as assumed and Equation ( |11.2[ ) we gam 
#(T J -_„) = O(|r| w_,o)a |r~ J Af ) = o(|r| (j " tt,)<5 



because r J N\ = 0(1), see Remark 11.5 on page 41 



and thus 



i\=o(\r\ 



S(J-w)—2(j-w) 



('' 



It 



|(5-2)j 



Now we want to make the summation in T> n independent from J, so we consider 

I i2J oo 



I 



E h 



X(V) ^ 3 



Again we use triangle inequality and we calculate the sum to obtain 



It 



2.7 



oo 

E 



|(<5-2)j 



Note that o(\t\ J ^ = O(N), see Remark 



>(h 



0( | r |27|,(«-2)J 



It 



i<5J 



Let us look at the growth of 



11.6 on page 41 



so we obtain |7| = 0(N 5 ). 



\2J J 



We get 



|^(7V)|=0(|r| 2J )^0(|r| ( ^) =0(|t| 2 ' 7 ) =0(7V 2 ), 



using <5 < 2, and, to get the last equality, Remark 11.6 on page 41 



Finally, inserting the result of Remark 111.5 on page 41 for the region of integration, rewriting 



\t\ 2J according to Remark 11.6 on page 41 and extending the sum to infinity, as above described, 
yields 

V V {N) 



,2J J 



E 



i ,2(c-{logJV}) cv 



\{V) 



E 



(l w ([yr^ w } 7 



5^1/£{|r|^ N >- c e(LlogJVJ)t/} a ._ 



KW))dy 



--■.4> v , v (\ogN) 



+ 0(N S ) 



with the rotation 9(x) — e l9x l0c . 
Now let 

e l6p U = U e~ i0v U = e- im U. 

Clearly the region of integration in ip^^-p^x) is p-periodic, since x occurs as {x} and \ x\ . All other 
occurrences of x are of the form {a;}, i.e., 1-periodic, so period p is obtained. □ 



44 
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Lemma 11.10 (The Other Part). For (11. Id) in the proof of Theorem 11.1 on page 38 we get 

Q V (N) = N 2 ^. Q + 0{N a log TV) + 0(N S ) , 

with 

~ h xiy) 

and a = 2 + logp < 2, where p < 1 can be found in Theorem \5.1 on page 1S\ 
Proof. Consider 



hi ■= 



lye[r- J NUi 0j 

We can rewrite the region of integration and get 

1 



w T J-w 



w)({yr>- w } nT] )dy. 



zGT,-_„ 



for some appropriate Tj^ w C Z[t], as in the proof of Lemma 11.8 on page 42 Substituting 
x = Ti~ w y, dx = \ T \ 2 ti- w ) yields 

1 



I 



' ' ' | r |2Ci-«0 



/ (%, j( - 1 w)({ I }s[rl) (il 



and further 



hi = , Jj_ w) J2 I ( 1 w v , e -^w)(x)da 



1 



,2(j -w) 



#(Tj- w ) fa, 



by splitting up the integral, using translation to eliminate the fractional part and taking fa ac- 

> From Pro 

\ T 3-w T -J N \ 



cording to ^ of Proposition 10.2 on page 33 From Proposition 9.3 on page 31 we obtain 



#(Tj- w ) = \n- w T- J N\ \{U) 
i r | 2 (j-™) i T | 2 0'-«') \{V) ' ~ \ | r | 2 W-™) 



o 



\t- j N 



,2 \(U) 

W) 



Or 



because \ T - J N\ = 0(1), see Remark 11.5 on page 41 
Now let us have a look at 



,2,7 J 



Qv(N) 



X(V) 



3=0 



Inserting the result above and using fa — 0(p e ), see of Proposition 10.2 on page 33 yields 



J2° 



v-m ( P J - 



We notice that \t\ 2J |r- J iV| 2 = N 2 . 



Therefore, after reversing the order of the first summation, we obtain 



w U xiy) 



3=0 



If p\t\ 2 5 > 1, then the second sum is JO(l), otherwise the sum is o(^p J \t\^ S 2 ^ J y So we 



obtain 



0(\r\ 2J p J j)+0(\r\ SJ ) 
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Using J = (log AT), see Lemma 11.4 on page 41 Remark 11.6 on page 41 and defining a 
2 + log p yields 

Qv(N) = N^£^-+O(N^<>\0gN)+O(N s ) . 



=0(N" log AT) 



Now consider the first sum. Since j3j — C(p J ), see of Proposition 10.2 on page 33 



iV 2 Pj = N 2 0(p J ) = 0(N a ) . 
j=j+i 

Thus the lemma is proved, because we can extend the sum to infinity. 



we obtain 



□ 



Lemma 11.11 (The Small Part). For (ll.lel in the proof of Theorem 11.1 on page 38 we get 

S V (N) = 0(N a \og N)+0(N 5 ) 
with a = 2 + logp < 2 and p < 1 from Theorem \5.1 on page 
Proof. Consider 



(l We -l w )({yri- w } )dy. 
>ve{T- J NU} Qj _ w K J/ 

Again, as in the proof of Lemma [11.9 on page 42[ the region of integration satisfies 
{r- J NU} 0i _ w Qd(r- J NU) 0] _ w = ^ \J V z , 



(11.3) 



for some appropriate Tj— W C 7L[t]. 

We substitute x = r^ w y, Ax = \ T ^^ W ^ dy m the integral to get 



eU 2E T,_„ v. 



(l Wt ~ %)(Wz[t]) da 



Again, after splitting up the integral, using translation to eliminate the fractional part and the 
triangle inequality, we get 



--\M 



in which \fy\ = O^p 1 } is known from m of Proposition 10.2 on page 33 Using #(d{NU)Q 
0(N S ), Remark 11.5 on page 41 and Equation (|11.3[) we get 



O 



#(T J -_„) = o(| 1 



,(j-w)6 I —J \ 



N = O 



('' 



iS(j-w) 



because r AH = 0(1). Thus 



l L|(«-2)(j-«) _ n ( J , i (<5— 2)j 



follows by assembling all together. 
Now we are ready to analyse 



Inserting the result above yields 



,2J J 



I 1 2.7 J / I i2J J 

i^wi = feUE (/- J 'M (5 " 2)A - p |r 

^ ' 3=0 



,2-5 



4<> 
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and thus, by the same argument as in the proof of Lemma |11.10 on page 44| 



P j \r 



\ 2J 0[j + p- J \r\^- 2)J 



O 



(p J \r\ 2J j)+o(\r\ SJ ), 



\S,(N)\ 

Finally, using Lemma |1 1 .4 on page 41| and Remark |11.6 on page 41| we obtain 

\S„(N)\ = 0(N a \ogN) + 0(N S ) 
with a = 2 + log p. Since p < 1, we have a < 2. 



□ 



Lemma 11.12 (The Fractional Cells Part). For (11. If I in the proof of Theorem 11.1 on page 38 
we get 

F V {N) = 0(N S log N) 
Proof. For the regions of integration in J 7 ^ we obtain 

W\ [NU] C |W| \ [NU\ = d(NU) ={JV Z 



and 



[Nlf] \ NU C |W| \ [NU\ = d(NU) =\JV Z 



for some appropriate T C 7L\r\ using Proposition 9.2 on page 29 Thus we get 



E 



^({ T J'+«}a[r]) 



dx < 



A(f) 



EE 



dx, 



in which the indicator function was replaced by 1. Dealing with the sums and the integral, which 
is 0(1), we obtain 

\F v (N)\ = (J +l)#TO(l). 
Since J = 0(logiV), see Lemma 11.4 on page 41 and #T = 0(N S ), the desired result follows. □ 



Lemma 11.13. If the ifi„ from Theorem 11.1 on page 38 is p -periodic, then ip^ is also continuous. 

Proof. There are two possible parts of ip^, where an discontinuity could occur. The first is {x} for 
an x £ %, the second is building {. . .}q in the region of integration in ip v ,v- 
The latter is no problem, i.e., no discontinuity, since 



v e{\T\W-°${\x\)v} ^ 



(^({^} IM )-w) d y 



ye\r\ 



{*}- 



■6([x\)U 



KW) dy, 



\ {X} ' C 6([ X \)U\ 



is zero, see proof of Lemma 



because the integral of the region 
Ipage 42| 

Now we deal with the continuity for x <G Z. Let m € x let M = \t\" 1 , and consider 

Z„(M)-Z„(M-1). 

For an appropriate a € R we get 

Z n (M) = aM 2 log M + M 2 ip n (log M) + 0(M a log M) + O (M s log M) , 

and thus 

Z V (M) = aM 2 m + M 2 ip v (m) + <D(M a m) + 0(M s m) . 

Further we obtain 

Z V (M - 1) = a (M - l) 2 log(M - 1) + (M - l) 2 V„(log(M - 1)) 



11.8 on 



+ 0((M - l) a log(M - 1)) + o((M - l) s log(M - 1)) , 
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11.4 on 



and thus, using the abbreviation L = log(l — M x ) and 5 > 1, 

Z V (M - 1) = aM 2 m + M 2 ip v (m + L) + 0{M a m) + 0(M 5 m) . 

Therefore we obtain 

Z n(M) ~Z,(M - I) = ^ {x) _ + L) + o(MQ -2 m) + ( M *-2 m ) _ 

Since #(MC7 \ (M — 1) U)q is clearly an upper bound for the number of ui-NAFs with values in 
MU \ (M — 1) U and each of these w-NAFs has less than [log M\ + c digits, see Lemma 
|page 41[ we obtain 

Z n (M) - Z n (M - 1) < #(Mf7 \ (M - 1) U) Q (m + c) . 

Using |b| of Proposition |9.3 on page 31| yields then 

Z V (M) - Z n [M - 1) = 0(M s m) . 

Therefore we get 

i/> n (x) -ip r ,(x + L) = (D(M s - 2 m) + 0(M a ~ 2 m) + 0(M 5 - 2 m) . 
Taking the limit m — > oo in steps of p, thus L tends to 0, and using a < 2 and S < 2 yields 

4>t]{x) — lim ipr](x + e) = 0, 
i.e., tpn is continuous for x E 7L. □ 

Acknowledgements 
We thank Stephan Wagner for contributing the proof of Lemma |5.2 on page 13| 

References 

1. Franz Aurenhammer, Voronoi diagrams — a survey of a fundamental geometric data structure, ACM Comput. 
Surv. 23 (1991), no. 3, 345-405. (Cited on page[6]) 

2. Roberto Avanzi, Clemens Heuberger, and Helmut Prodinger, Arithmetic of super singular Koblitz curves in 
characteristic three, Tech. Report 2010-8, Graz University of Technology, 2010, http://www.math.tugraz.at/ 
f osp/pdf s/tugraz_0166 .pdf also available as Cryptology ePrint Archive, Report 2010/436, http : //eprint . 
iacr.org/ (Cited on page|4|) 

3. Michael Barnsley, Fractals everywhere, Academic Press, Inc, 1988. (Cited on page [26]) 

4. Ian F. Blake, V. Kumar Murty, and Guangwu Xu, Efficient algorithms for Koblitz curves over fields of char- 
acteristic three, J. Discrete Algorithms 3 (2005), no. 1, 113-124. (Cited on pages[4]|9] and [22]) 

5. , A note on window r-NAF algorithm, Inform. Process. Lett. 95 (2005), 496-502. (Cited on pages [4] 

and [22]) 

6. , Nonadjacent radix-r expansions of integers in Euclidean imaginary quadratic number fields, Canad. 

J. Math. 60 (2008), no. 6, 1267-1282. (Cited on pages [i] and [22]) 

7. Hubert Delange, Sur la fonction sommatoire de la fonction "somme des chiffres", Enseignement Math. (2) 21 
(1975), 31-47. (Cited on pages [2] and [39]) 

8. Gerald A. Edgar, Measure, topology, and fractal geometry, second ed., Undergraduate Texts in Mathematics, 
Springer- Verlag, New York, 2008. (Cited on pages [Tl] [26] [28] and [29]) 

9. Daniel M. Gordon, A survey of fast exponentiation methods, J. Algorithms 27 (1998), 129—146. (Cited on 
Page [1]) 

10. Peter J. Grabner, Clemens Heuberger, and Helmut Prodinger, Distribution results for low-weight binary rep- 
resentations for pairs of integers, Theoret. Comput. Sci. 319 (2004), 307—331. (Cited on page[2]) 

11. Ronald L. Graham, Donald E. Knuth, and Oren Patashnik, Concrete mathematics. A foundation for computer 
science, second ed., Addison-Wesley, 1994. (Cited on pages [l6| and [38] ) 

12. Clemens Heuberger and Helmut Prodinger, Analysis of alternative digit sets for nonadjacent representations, 
Monatsh. Math. 147 (2006), 219-248. (Cited on pages pi] and [27] ) 

13. Hsien-Kuci Hwang, On convergence rates in the central limit theorems for combinatorial structures, European 
J. Combin. 19 (1998), 329-343. (Cited on page[i"4]) 

14. Neal Koblitz, CM-curves with good cryptographic properties, Advances in cryptology — CRYPTO '91 (Santa 
Barbara, CA, 1991), Lecture Notes in Comput. Sci., vol. 576, Springer, Berlin, 1992, pp. 279-287. (Cited on 
page [I]) 



48 



CLEMENS HEUBERGER. AND DANIEL KRENN 



15. , An elliptic curve implementation of the finite field digital signature algorithm, Advances in 

cryptology — CRYPTO '98 (Santa Barbara, CA, 1998), Lecture Notes in Comput. Sci., vol. 1462, Springer, 
Berlin, 1998, pp. 327-337. (Cited on pages[4|[2|] andpB]) 

16. David W. Matula, Basic digit sets for radix representation, J. Assoc. Comput. Mach. 29 (1982), no. 4, 1131- 
1143. (Cited on pages |l5| and |22|) 

17. James A. Muir and Douglas R. Stinson, Alternative digit sets for nonadjacent representations, Selected areas 
in cryptography, Lecture Notes in Comput. Sci., vol. 3006, Springer, Berlin, 2004, pp. 306-319. (Cited on 
page[T2]) 

18. George W. Reitwiesner, Binary arithmetic, Advances in computers, vol. 1, Academic Press, New York, 1960, 
pp. 231-308. (Cited on page[2]) 

19. Jerome A. Solinas, An improved algorithm for arithmetic on a family of elliptic curves, Advances in Cryptology 
— CRYPTO '97. 17th annual international cryptology conference. Santa Barbara, CA, USA. August 17-21, 
1997. Proceedings (B. S. Kaliski, jun., ed.), Lecture Notes in Comput. Sci., vol. 1294, Springer, Berlin, 1997, 
pp. 357-371. (Cited on pages[2][I] and[9]) 

20. , Efficient arithmetic on Koblitz curves, Des. Codes Cryptogr. 19 (2000), 195-249. (Cited on pages[2] 

m mm and^ 

Clemens Heuberger 

Institute of Optimisation and Discrete Mathematics (Math B) 
Graz University of Technology 
Steyrergasse 30/11, A-8010 Graz, Austria 

E-mail address: Clemens . heubergerOtugraz . at 

Daniel Krenn 

Institute of Optimisation and Discrete Mathematics (Math B) 
Graz University of Technology 
Steyrergasse 30/11, A-8010 Graz, Austria 

E-mail address: mathOdanielkrenn. at or krennSmath . tugraz . at 



